nss: Fix CVE-2020-25648

Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
author: Mathieu Dubois-Briand <mbriand@witekio.com> 2022-12-08 15:38:53 +0100
committer: Armin Kuster <akuster808@gmail.com> 2023-02-22 11:24:23 -0500
commit: 56403db5e393ca9ccf4ede6ea19ff212984a27c4 (patch)
tree: 600db4614fc9b7153141c7082d665f6fc62824cf
parent: 50b6fb7d62831e763afae1ae91021bc2e74d2889 (diff)
download: meta-openembedded-56403db5e393ca9ccf4ede6ea19ff212984a27c4.tar.gz
2 files changed, 164 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/nss/nss/CVE-2020-25648.patch b/meta-oe/recipes-support/nss/nss/CVE-2020-25648.patch
new file mode 100644
index 0000000000..f30d4d32cd
--- /dev/null
+++ b/meta-oe/recipes-support/nss/nss/CVE-2020-25648.patch
@@ -0,0 +1,163 @@
+# HG changeset patch
+# User Daiki Ueno <dueno@redhat.com>
+# Date 1602524521 0
+# Node ID 57bbefa793232586d27cee83e74411171e128361
+# Parent  6e3bc17f05086854ffd2b06f7fae9371f7a0c174
+Bug 1641480, TLS 1.3: tighten CCS handling in compatibility mode, r=mt
+This makes the server reject CCS when the client doesn't indicate the
+use of the middlebox compatibility mode with a non-empty
+ClientHello.legacy_session_id, or it sends multiple CCS in a row.
+Differential Revision: https://phabricator.services.mozilla.com/D79994
+Upstream-Status: Backport
+CVE: CVE-2020-25648
+Reference to upstream patch: https://hg.mozilla.org/projects/nss/rev/57bbefa793232586d27cee83e74411171e128361
+Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
+diff --color -Naur nss-3.51.1_old/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc nss-3.51.1/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc
+--- nss-3.51.1_old/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc     2022-12-08 16:05:47.447142660 +0100
+++ nss-3.51.1/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc 2022-12-08 16:12:32.645932052 +0100
+@@ -348,6 +348,85 @@
+   client_->CheckErrorCode(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT);
+ }
+ 
+// The server rejects a ChangeCipherSpec if the client advertises an
+// empty session ID.
+TEST_F(TlsConnectStreamTls13, ChangeCipherSpecAfterClientHelloEmptySid) {
+  EnsureTlsSetup();
+  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
+
+  StartConnect();
+  client_->Handshake();  // Send ClientHello
+  client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));  // Send CCS
+
+  server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
+  server_->Handshake();  // Consume ClientHello and CCS
+  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
+}
+
+// The server rejects multiple ChangeCipherSpec even if the client
+// indicates compatibility mode with non-empty session ID.
+TEST_F(Tls13CompatTest, ChangeCipherSpecAfterClientHelloTwice) {
+  EnsureTlsSetup();
+  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
+  EnableCompatMode();
+
+  StartConnect();
+  client_->Handshake();  // Send ClientHello
+  // Send CCS twice in a row
+  client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));
+  client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));
+
+  server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
+  server_->Handshake();  // Consume ClientHello and CCS.
+  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
+}
+
+// The client rejects a ChangeCipherSpec if it advertises an empty
+// session ID.
+TEST_F(TlsConnectStreamTls13, ChangeCipherSpecAfterServerHelloEmptySid) {
+  EnsureTlsSetup();
+  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
+
+  // To replace Finished with a CCS below
+  auto filter = MakeTlsFilter<TlsHandshakeDropper>(server_);
+  filter->SetHandshakeTypes({kTlsHandshakeFinished});
+  filter->EnableDecryption();
+
+  StartConnect();
+  client_->Handshake();  // Send ClientHello
+  server_->Handshake();  // Consume ClientHello, and
+                         // send ServerHello..CertificateVerify
+  // Send CCS
+  server_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));
+  client_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
+  client_->Handshake();  // Consume ClientHello and CCS
+  client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
+}
+
+// The client rejects multiple ChangeCipherSpec in a row even if the
+// client indicates compatibility mode with non-empty session ID.
+TEST_F(Tls13CompatTest, ChangeCipherSpecAfterServerHelloTwice) {
+  EnsureTlsSetup();
+  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
+  EnableCompatMode();
+
+  // To replace Finished with a CCS below
+  auto filter = MakeTlsFilter<TlsHandshakeDropper>(server_);
+  filter->SetHandshakeTypes({kTlsHandshakeFinished});
+  filter->EnableDecryption();
+
+  StartConnect();
+  client_->Handshake();  // Send ClientHello
+  server_->Handshake();  // Consume ClientHello, and
+                         // send ServerHello..CertificateVerify
+                         // the ServerHello is followed by CCS
+  // Send another CCS
+  server_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));
+  client_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
+  client_->Handshake();  // Consume ClientHello and CCS
+  client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
+}
+
+ // If we negotiate 1.2, we abort.
+ TEST_F(TlsConnectStreamTls13, ChangeCipherSpecBeforeClientHello12) {
+   EnsureTlsSetup();
+diff --color -Naur nss-3.51.1_old/nss/lib/ssl/ssl3con.c nss-3.51.1/nss/lib/ssl/ssl3con.c
+--- nss-3.51.1_old/nss/lib/ssl/ssl3con.c        2022-12-08 16:05:47.471142833 +0100
+++ nss-3.51.1/nss/lib/ssl/ssl3con.c    2022-12-08 16:12:42.037994262 +0100
+@@ -6711,7 +6711,11 @@
+ 
+     /* TLS 1.3: We sent a session ID.  The server's should match. */
+     if (!IS_DTLS(ss) && (sentRealSid || sentFakeSid)) {
+-        return sidMatch;
+        if (sidMatch) {
+            ss->ssl3.hs.allowCcs = PR_TRUE;
+            return PR_TRUE;
+        }
+        return PR_FALSE;
+     }
+ 
+     /* TLS 1.3 (no SID)/DTLS 1.3: The server shouldn't send a session ID. */
+@@ -8730,6 +8734,7 @@
+                 errCode = PORT_GetError();
+                 goto alert_loser;
+             }
+            ss->ssl3.hs.allowCcs = PR_TRUE;
+         }
+ 
+         /* TLS 1.3 requires that compression include only null. */
+@@ -13058,8 +13063,15 @@
+             ss->ssl3.hs.ws != idle_handshake &&
+             cText->buf->len == 1 &&
+             cText->buf->buf[0] == change_cipher_spec_choice) {
+-            /* Ignore the CCS. */
+-            return SECSuccess;
+            if (ss->ssl3.hs.allowCcs) {
+                /* Ignore the first CCS. */
+                ss->ssl3.hs.allowCcs = PR_FALSE;
+                return SECSuccess;
+            }
+
+            /* Compatibility mode is not negotiated. */
+            alert = unexpected_message;
+            PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
+         }
+ 
+         if (IS_DTLS(ss) ||
+diff --color -Naur nss-3.51.1_old/nss/lib/ssl/sslimpl.h nss-3.51.1/nss/lib/ssl/sslimpl.h
+--- nss-3.51.1_old/nss/lib/ssl/sslimpl.h        2022-12-08 16:05:47.471142833 +0100
+++ nss-3.51.1/nss/lib/ssl/sslimpl.h    2022-12-08 16:12:45.106014567 +0100
+@@ -711,6 +711,10 @@
+                                            * or received. */
+     PRBool receivedCcs;                   /* A server received ChangeCipherSpec
+                                            * before the handshake started. */
+    PRBool allowCcs;                      /* A server allows ChangeCipherSpec
+                                           * as the middlebox compatibility mode
+                                           * is explicitly indicarted by
+                                           * legacy_session_id in TLS 1.3 ClientHello. */
+     PRBool clientCertRequested;           /* True if CertificateRequest received. */
+     ssl3KEADef kea_def_mutable;           /* Used to hold the writable kea_def
+                                            * we use for TLS 1.3 */
diff --git a/meta-oe/recipes-support/nss/nss_3.51.1.bb b/meta-oe/recipes-support/nss/nss_3.51.1.bb
index 0827780c25..07adea1067 100644
--- a/meta-oe/recipes-support/nss/nss_3.51.1.bb
+++ b/meta-oe/recipes-support/nss/nss_3.51.1.bb
@@ -39,6 +39,7 @@ SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSIO
           file://CVE-2020-6829_12400.patch \
           file://CVE-2020-12403_1.patch \
           file://CVE-2020-12403_2.patch \
+           file://CVE-2020-25648.patch \
           file://CVE-2021-43527.patch \
           file://CVE-2022-22747.patch \
           "
author	Mathieu Dubois-Briand <mbriand@witekio.com>	2022-12-08 15:38:53 +0100
committer	Armin Kuster <akuster808@gmail.com>	2023-02-22 11:24:23 -0500
commit	56403db5e393ca9ccf4ede6ea19ff212984a27c4 (patch)
tree	600db4614fc9b7153141c7082d665f6fc62824cf
parent	50b6fb7d62831e763afae1ae91021bc2e74d2889 (diff)
download	meta-openembedded-56403db5e393ca9ccf4ede6ea19ff212984a27c4.tar.gz

diff --git a/meta-oe/recipes-support/nss/nss/CVE-2020-25648.patch b/meta-oe/recipes-support/nss/nss/CVE-2020-25648.patch new file mode 100644 index 0000000000..f30d4d32cd --- /dev/null +++ b/meta-oe/recipes-support/nss/nss/CVE-2020-25648.patch
@@ -0,0 +1,163 @@
		1	# HG changeset patch
		2	# User Daiki Ueno <dueno@redhat.com>
		3	# Date 1602524521 0
		4	# Node ID 57bbefa793232586d27cee83e74411171e128361
		5	# Parent 6e3bc17f05086854ffd2b06f7fae9371f7a0c174
		6	Bug 1641480, TLS 1.3: tighten CCS handling in compatibility mode, r=mt
		7
		8	This makes the server reject CCS when the client doesn't indicate the
		9	use of the middlebox compatibility mode with a non-empty
		10	ClientHello.legacy_session_id, or it sends multiple CCS in a row.
		11
		12	Differential Revision: https://phabricator.services.mozilla.com/D79994
		13
		14	Upstream-Status: Backport
		15	CVE: CVE-2020-25648
		16	Reference to upstream patch: https://hg.mozilla.org/projects/nss/rev/57bbefa793232586d27cee83e74411171e128361
		17	Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
		18
		19	diff --color -Naur nss-3.51.1_old/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc nss-3.51.1/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc
		20	--- nss-3.51.1_old/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc 2022-12-08 16:05:47.447142660 +0100
		21	+++ nss-3.51.1/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc 2022-12-08 16:12:32.645932052 +0100
		22	@@ -348,6 +348,85 @@
		23	client_->CheckErrorCode(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT);
		24	}
		25
		26	+// The server rejects a ChangeCipherSpec if the client advertises an
		27	+// empty session ID.
		28	+TEST_F(TlsConnectStreamTls13, ChangeCipherSpecAfterClientHelloEmptySid) {
		29	+ EnsureTlsSetup();
		30	+ ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
		31	+
		32	+ StartConnect();
		33	+ client_->Handshake(); // Send ClientHello
		34	+ client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); // Send CCS
		35	+
		36	+ server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
		37	+ server_->Handshake(); // Consume ClientHello and CCS
		38	+ server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
		39	+}
		40	+
		41	+// The server rejects multiple ChangeCipherSpec even if the client
		42	+// indicates compatibility mode with non-empty session ID.
		43	+TEST_F(Tls13CompatTest, ChangeCipherSpecAfterClientHelloTwice) {
		44	+ EnsureTlsSetup();
		45	+ ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
		46	+ EnableCompatMode();
		47	+
		48	+ StartConnect();
		49	+ client_->Handshake(); // Send ClientHello
		50	+ // Send CCS twice in a row
		51	+ client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));
		52	+ client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));
		53	+
		54	+ server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
		55	+ server_->Handshake(); // Consume ClientHello and CCS.
		56	+ server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
		57	+}
		58	+
		59	+// The client rejects a ChangeCipherSpec if it advertises an empty
		60	+// session ID.
		61	+TEST_F(TlsConnectStreamTls13, ChangeCipherSpecAfterServerHelloEmptySid) {
		62	+ EnsureTlsSetup();
		63	+ ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
		64	+
		65	+ // To replace Finished with a CCS below
		66	+ auto filter = MakeTlsFilter<TlsHandshakeDropper>(server_);
		67	+ filter->SetHandshakeTypes({kTlsHandshakeFinished});
		68	+ filter->EnableDecryption();
		69	+
		70	+ StartConnect();
		71	+ client_->Handshake(); // Send ClientHello
		72	+ server_->Handshake(); // Consume ClientHello, and
		73	+ // send ServerHello..CertificateVerify
		74	+ // Send CCS
		75	+ server_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));
		76	+ client_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
		77	+ client_->Handshake(); // Consume ClientHello and CCS
		78	+ client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
		79	+}
		80	+
		81	+// The client rejects multiple ChangeCipherSpec in a row even if the
		82	+// client indicates compatibility mode with non-empty session ID.
		83	+TEST_F(Tls13CompatTest, ChangeCipherSpecAfterServerHelloTwice) {
		84	+ EnsureTlsSetup();
		85	+ ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
		86	+ EnableCompatMode();
		87	+
		88	+ // To replace Finished with a CCS below
		89	+ auto filter = MakeTlsFilter<TlsHandshakeDropper>(server_);
		90	+ filter->SetHandshakeTypes({kTlsHandshakeFinished});
		91	+ filter->EnableDecryption();
		92	+
		93	+ StartConnect();
		94	+ client_->Handshake(); // Send ClientHello
		95	+ server_->Handshake(); // Consume ClientHello, and
		96	+ // send ServerHello..CertificateVerify
		97	+ // the ServerHello is followed by CCS
		98	+ // Send another CCS
		99	+ server_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs)));
		100	+ client_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
		101	+ client_->Handshake(); // Consume ClientHello and CCS
		102	+ client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
		103	+}
		104	+
		105	// If we negotiate 1.2, we abort.
		106	TEST_F(TlsConnectStreamTls13, ChangeCipherSpecBeforeClientHello12) {
		107	EnsureTlsSetup();
		108	diff --color -Naur nss-3.51.1_old/nss/lib/ssl/ssl3con.c nss-3.51.1/nss/lib/ssl/ssl3con.c
		109	--- nss-3.51.1_old/nss/lib/ssl/ssl3con.c 2022-12-08 16:05:47.471142833 +0100
		110	+++ nss-3.51.1/nss/lib/ssl/ssl3con.c 2022-12-08 16:12:42.037994262 +0100
		111	@@ -6711,7 +6711,11 @@
		112
		113	/* TLS 1.3: We sent a session ID. The server's should match. */
		114	if (!IS_DTLS(ss) && (sentRealSid \|\| sentFakeSid)) {
		115	- return sidMatch;
		116	+ if (sidMatch) {
		117	+ ss->ssl3.hs.allowCcs = PR_TRUE;
		118	+ return PR_TRUE;
		119	+ }
		120	+ return PR_FALSE;
		121	}
		122
		123	/* TLS 1.3 (no SID)/DTLS 1.3: The server shouldn't send a session ID. */
		124	@@ -8730,6 +8734,7 @@
		125	errCode = PORT_GetError();
		126	goto alert_loser;
		127	}
		128	+ ss->ssl3.hs.allowCcs = PR_TRUE;
		129	}
		130
		131	/* TLS 1.3 requires that compression include only null. */
		132	@@ -13058,8 +13063,15 @@
		133	ss->ssl3.hs.ws != idle_handshake &&
		134	cText->buf->len == 1 &&
		135	cText->buf->buf[0] == change_cipher_spec_choice) {
		136	- /* Ignore the CCS. */
		137	- return SECSuccess;
		138	+ if (ss->ssl3.hs.allowCcs) {
		139	+ /* Ignore the first CCS. */
		140	+ ss->ssl3.hs.allowCcs = PR_FALSE;
		141	+ return SECSuccess;
		142	+ }
		143	+
		144	+ /* Compatibility mode is not negotiated. */
		145	+ alert = unexpected_message;
		146	+ PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
		147	}
		148
		149	if (IS_DTLS(ss) \|\|
		150	diff --color -Naur nss-3.51.1_old/nss/lib/ssl/sslimpl.h nss-3.51.1/nss/lib/ssl/sslimpl.h
		151	--- nss-3.51.1_old/nss/lib/ssl/sslimpl.h 2022-12-08 16:05:47.471142833 +0100
		152	+++ nss-3.51.1/nss/lib/ssl/sslimpl.h 2022-12-08 16:12:45.106014567 +0100
		153	@@ -711,6 +711,10 @@
		154	* or received. */
		155	PRBool receivedCcs; /* A server received ChangeCipherSpec
		156	* before the handshake started. */
		157	+ PRBool allowCcs; /* A server allows ChangeCipherSpec
		158	+ * as the middlebox compatibility mode
		159	+ * is explicitly indicarted by
		160	+ * legacy_session_id in TLS 1.3 ClientHello. */
		161	PRBool clientCertRequested; /* True if CertificateRequest received. */
		162	ssl3KEADef kea_def_mutable; /* Used to hold the writable kea_def
		163	* we use for TLS 1.3 */


diff --git a/meta-oe/recipes-support/nss/nss_3.51.1.bb b/meta-oe/recipes-support/nss/nss_3.51.1.bb index 0827780c25..07adea1067 100644 --- a/meta-oe/recipes-support/nss/nss_3.51.1.bb +++ b/meta-oe/recipes-support/nss/nss_3.51.1.bb
@@ -39,6 +39,7 @@ SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSIO
39	file://CVE-2020-6829_12400.patch \	39	file://CVE-2020-6829_12400.patch \
40	file://CVE-2020-12403_1.patch \	40	file://CVE-2020-12403_1.patch \
41	file://CVE-2020-12403_2.patch \	41	file://CVE-2020-12403_2.patch \
		42	file://CVE-2020-25648.patch \
42	file://CVE-2021-43527.patch \	43	file://CVE-2021-43527.patch \
43	file://CVE-2022-22747.patch \	44	file://CVE-2022-22747.patch \
44	"	45	"