OpenSSL 1.1.0 ssl_add_clienthello_tlsext 内存损坏

历史差异连接jsonxmlCTI

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
6.6	$0-$5k	0.00

摘要信息

在OpenSSL 1.1.0中曾发现一漏洞，此漏洞被分类为致命。受影响的是功能ssl_add_clienthello_tlsext。对的操作导致内存损坏。攻击可以远程发起，另外，有可用的漏洞利用。

在OpenSSL 1.1.0中曾发现一漏洞，此漏洞被分类为致命。受影响的是功能ssl_add_clienthello_tlsext。对的操作导致内存损坏。使用 CWE 声明该问题会导致 CWE-122。此漏洞的脆弱性 2016-10-13由公示人Guido Vranken、公示人类型为Mailinglist Post (Full-Disclosure)所提交。该安全通告已在 seclists.org 提供下载。

攻击可以远程发起，技术详情可用。该漏洞的流行度低于平均水平。另外，有可用的漏洞利用。该漏洞的利用方式已向公众披露，存在被利用的风险。现在，可能约为美元 $0-$5k。此漏洞的原因在于以下代码部分：

if ((long)(limit - ret - 7 - extlen - idlen) < 0)
    return NULL;
s2n(TLSEXT_TYPE_status_request, ret);
if (extlen + idlen > 0xFFF0)
    return NULL;
s2n(extlen + idlen + 5, ret);
*(ret++) = TLSEXT_STATUSTYPE_ocsp;
s2n(idlen, ret);
for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++) {
    / save position of id len /
    unsigned char *q = ret;
    id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
    / skip over id len /
    ret += 2;
    itmp = i2d_OCSP_RESPID(id, &ret);
    / write id len /
    s2n(itmp, q);
}
s2n(extlen, ret);
1283if (extlen > 0)
1284    i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);

公告指出：

(...) if an attacker can somehow influence the ALPN list of an OpenSSL-enabled application (perhaps through another vulnerability), the attacker can write arbitrary data past OpenSSL's heap buffer.

如果存在长度，则其被声明为概念验证。漏洞利用已在seclists.org提供下载。估计零日攻击的地下价格约为$25k-$100k。该漏洞利用所用的代码为：

openssl s_client -reconnect -status -alpn `python -c "import sys;
sys.stdout.write('x,'*4000+'x')"`

公告指出：

It doesn’t crash immediately after ‘ret’ crosses ‘limit’ because the buffer is over-allocated by the code in crypto/buffer/buffer.c (...) And just to be clear, you don’t need to modify the source code of the client in order to make this work. You only need to modify the server code (a separate build if you want) so it sends large tickets.

公告包含以下备注：

Triggering this requires that the client sets a very large ALPN list (several thousand bytes). This would be very unusual in a real-world application. For this reason OpenSSL does not treat this as a security vulnerability and I am inclined to agree with this decision.