fix CVE-2021-42778 CVE-2021-42780
This commit is contained in:
Hugel
parent
25670d8abd
commit
a43b4c0dbc
54
backport-CVE-2021-42778-idprime-Use-temporary.patch
Normal file
54
backport-CVE-2021-42778-idprime-Use-temporary.patch
Normal file
@ -0,0 +1,54 @@
|
||||
From f015746d22d249642c19674298a18ad824db0ed7 Mon Sep 17 00:00:00 2001
|
||||
From: Jakub Jelen <jjelen@redhat.com>
|
||||
Date: Wed, 2 Dec 2020 13:15:11 +0100
|
||||
Subject: [PATCH] idprime: Use temporary variable instead of messing up the
|
||||
passed one
|
||||
|
||||
Thanks oss-fuzz
|
||||
|
||||
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185
|
||||
---
|
||||
src/libopensc/card-idprime.c | 15 +++++++++------
|
||||
1 file changed, 9 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/libopensc/card-idprime.c b/src/libopensc/card-idprime.c
|
||||
index cf933140c1..8ca393d11d 100644
|
||||
--- a/src/libopensc/card-idprime.c
|
||||
+++ b/src/libopensc/card-idprime.c
|
||||
@@ -418,6 +418,7 @@ static int idprime_get_token_name(sc_card_t* card, char** tname)
|
||||
sc_path_t tinfo_path = {"\x00\x00", 2, 0, 0, SC_PATH_TYPE_PATH, {"", 0}};
|
||||
sc_file_t *file = NULL;
|
||||
u8 buf[2];
|
||||
+ char *name;
|
||||
int r;
|
||||
|
||||
LOG_FUNC_CALLED(card->ctx);
|
||||
@@ -445,20 +446,22 @@ static int idprime_get_token_name(sc_card_t* card, char** tname)
|
||||
}
|
||||
sc_file_free(file);
|
||||
|
||||
- *tname = malloc(buf[1]);
|
||||
- if (*tname == NULL) {
|
||||
+ name = malloc(buf[1]);
|
||||
+ if (name == NULL) {
|
||||
LOG_FUNC_RETURN(card->ctx, SC_ERROR_OUT_OF_MEMORY);
|
||||
}
|
||||
|
||||
- r = iso_ops->read_binary(card, 2, (unsigned char *)*tname, buf[1], 0);
|
||||
+ r = iso_ops->read_binary(card, 2, (unsigned char *)name, buf[1], 0);
|
||||
if (r < 1) {
|
||||
- free(*tname);
|
||||
+ free(name);
|
||||
LOG_FUNC_RETURN(card->ctx, r);
|
||||
}
|
||||
|
||||
- if ((*tname)[r-1] != '\0') {
|
||||
- (*tname)[r-1] = '\0';
|
||||
+ if (name[r-1] != '\0') {
|
||||
+ name[r-1] = '\0';
|
||||
}
|
||||
+ *tname = name;
|
||||
+
|
||||
LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);
|
||||
}
|
||||
|
||||
@ -0,0 +1,33 @@
|
||||
From 5df913b7f57ad89b9832555d24c08d23a534311e Mon Sep 17 00:00:00 2001
|
||||
From: Jakub Jelen <jjelen@redhat.com>
|
||||
Date: Tue, 8 Dec 2020 14:37:39 +0100
|
||||
Subject: [PATCH] tcos: Check bounds in insert_pin()
|
||||
|
||||
Thanks oss-fuzz
|
||||
|
||||
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383
|
||||
---
|
||||
src/libopensc/pkcs15-tcos.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/libopensc/pkcs15-tcos.c b/src/libopensc/pkcs15-tcos.c
|
||||
index feeb7eb39d..74ae0cb92f 100644
|
||||
--- a/src/libopensc/pkcs15-tcos.c
|
||||
+++ b/src/libopensc/pkcs15-tcos.c
|
||||
@@ -242,13 +242,13 @@ static int insert_pin(
|
||||
"Searching for PIN-Ref %02X\n", pin_reference);
|
||||
while ((r = sc_read_record(card, ++rec_no, buf, sizeof(buf), SC_RECORD_BY_REC_NR)) > 0) {
|
||||
int found = 0, fbz = -1;
|
||||
- if (buf[0] != 0xA0)
|
||||
+ if (r < 2 || buf[0] != 0xA0)
|
||||
continue;
|
||||
- for (i = 2; i < buf[1] + 2; i += 2 + buf[i + 1]) {
|
||||
+ for (i = 2; i < buf[1] + 2 && (i + 2) < r; i += 2 + buf[i + 1]) {
|
||||
if (buf[i] == 0x83 && buf[i + 1] == 1 && buf[i + 2] == pin_reference) {
|
||||
++found;
|
||||
}
|
||||
- if (buf[i] == 0x90) {
|
||||
+ if (buf[i] == 0x90 && (i + 1 + buf[i + 1]) < r) {
|
||||
fbz = buf[i + 1 + buf[i + 1]];
|
||||
}
|
||||
}
|
||||
73
backport-tcos-Reformat-insert_pin-for-readability.patch
Normal file
73
backport-tcos-Reformat-insert_pin-for-readability.patch
Normal file
@ -0,0 +1,73 @@
|
||||
From 69544553c36f0613f6283e0eeb3f9eb549825986 Mon Sep 17 00:00:00 2001
|
||||
From: Jakub Jelen <jjelen@redhat.com>
|
||||
Date: Mon, 7 Dec 2020 17:44:34 +0100
|
||||
Subject: [PATCH] tcos: Reformat insert_pin() for readability
|
||||
|
||||
---
|
||||
src/libopensc/pkcs15-tcos.c | 35 ++++++++++++++++++++++-------------
|
||||
1 file changed, 22 insertions(+), 13 deletions(-)
|
||||
|
||||
diff --git a/src/libopensc/pkcs15-tcos.c b/src/libopensc/pkcs15-tcos.c
|
||||
index 1134ac11ba..feeb7eb39d 100644
|
||||
--- a/src/libopensc/pkcs15-tcos.c
|
||||
+++ b/src/libopensc/pkcs15-tcos.c
|
||||
@@ -225,12 +225,14 @@ static int insert_pin(
|
||||
pin_obj.auth_id.len = auth_id ? 0 : 1;
|
||||
pin_obj.auth_id.value[0] = auth_id;
|
||||
|
||||
- if(card->type==SC_CARD_TYPE_TCOS_V3){
|
||||
+ if(card->type == SC_CARD_TYPE_TCOS_V3) {
|
||||
unsigned char buf[256];
|
||||
int i, rec_no=0;
|
||||
- if(pin_info.path.len>=2) pin_info.path.len-=2;
|
||||
+ if (pin_info.path.len >= 2) {
|
||||
+ pin_info.path.len -= 2;
|
||||
+ }
|
||||
sc_append_file_id(&pin_info.path, 0x5049);
|
||||
- if(sc_select_file(card, &pin_info.path, NULL)!=SC_SUCCESS){
|
||||
+ if (sc_select_file(card, &pin_info.path, NULL) != SC_SUCCESS) {
|
||||
sc_log(ctx,
|
||||
"Select(%s) failed\n",
|
||||
sc_print_path(&pin_info.path));
|
||||
@@ -238,17 +240,24 @@ static int insert_pin(
|
||||
}
|
||||
sc_log(ctx,
|
||||
"Searching for PIN-Ref %02X\n", pin_reference);
|
||||
- while((r=sc_read_record(card, ++rec_no, buf, sizeof(buf), SC_RECORD_BY_REC_NR))>0){
|
||||
- int found=0, fbz=-1;
|
||||
- if(buf[0]!=0xA0) continue;
|
||||
- for(i=2;i<buf[1]+2;i+=2+buf[i+1]){
|
||||
- if(buf[i]==0x83 && buf[i+1]==1 && buf[i+2]==pin_reference) ++found;
|
||||
- if(buf[i]==0x90) fbz=buf[i+1+buf[i+1]];
|
||||
+ while ((r = sc_read_record(card, ++rec_no, buf, sizeof(buf), SC_RECORD_BY_REC_NR)) > 0) {
|
||||
+ int found = 0, fbz = -1;
|
||||
+ if (buf[0] != 0xA0)
|
||||
+ continue;
|
||||
+ for (i = 2; i < buf[1] + 2; i += 2 + buf[i + 1]) {
|
||||
+ if (buf[i] == 0x83 && buf[i + 1] == 1 && buf[i + 2] == pin_reference) {
|
||||
+ ++found;
|
||||
+ }
|
||||
+ if (buf[i] == 0x90) {
|
||||
+ fbz = buf[i + 1 + buf[i + 1]];
|
||||
+ }
|
||||
+ }
|
||||
+ if (found) {
|
||||
+ pin_info.tries_left = fbz;
|
||||
+ break;
|
||||
}
|
||||
- if(found) pin_info.tries_left=fbz;
|
||||
- if(found) break;
|
||||
}
|
||||
- if(r<=0){
|
||||
+ if (r <= 0) {
|
||||
sc_log(ctx, "No EF_PWDD-Record found\n");
|
||||
return 1;
|
||||
}
|
||||
@@ -259,6 +268,6 @@ static int insert_pin(
|
||||
return 1;
|
||||
}
|
||||
- pin_info.tries_left=f->prop_attr[3];
|
||||
+ pin_info.tries_left = f->prop_attr[3];
|
||||
sc_file_free(f);
|
||||
}
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
|
||||
Name: opensc
|
||||
Version: 0.21.0
|
||||
Release: 4
|
||||
Release: 5
|
||||
License: LGPLv2.1+
|
||||
Summary: Smart card library and applications
|
||||
URL: https://github.com/OpenSC/OpenSC/wiki
|
||||
@ -30,6 +30,9 @@ Patch9: oberthur-One-more-overlooked-buffer-overflow.patch
|
||||
Patch10: cardos-Correctly-calculate-the-left-bytes-to-avoid-b.patch
|
||||
Patch11: oberthur-Handle-1B-OIDs.patch
|
||||
Patch12: Fix-ACLs-support.patch
|
||||
Patch13: backport-CVE-2021-42778-idprime-Use-temporary.patch
|
||||
Patch14: backport-tcos-Reformat-insert_pin-for-readability.patch
|
||||
Patch15: backport-CVE-2021-42780-tcos-Check-bounds-in-insert_pin.patch
|
||||
|
||||
%description
|
||||
OpenSC provides a set of libraries and utilities to work with smart cards.
|
||||
@ -148,6 +151,9 @@ make check
|
||||
%{_datadir}/opensc/
|
||||
|
||||
%changelog
|
||||
* Mon May 9 2022 Hugel <gengqihu1@h-partners.com> - 0.21.0-5
|
||||
- fix CVE-2021-42778 CVE-2021-42780
|
||||
|
||||
* Tue Aug 24 2021 wangjie <wangjie375@huawei.com> - 0.21.0-4
|
||||
- fix oss-fuzz
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user