December 2016 - tor-commits - lists.torproject.org

[tor/maint-0.2.6] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit db58d4d16ff156b8827198b2732646c73eb59f14 Merge: 3d2d3f2 0fb3058 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:11:08 2016 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug21018 | 11 +++++++++++ src/or/rendcommon.c | 6 ++++-- src/or/routerparse.c | 6 +++--- 3 files changed, 18 insertions(+), 5 deletions(-) diff --cc src/or/rendcommon.c index bd701b2,296df55..9637d4d --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@@ -1113,8 -1327,11 +1113,10 @@@ rend_cache_store_v2_desc_as_client(cons intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); - retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) { log_warn(LD_REND, "Found too many introduction points on a hidden "

1 0

[tor/maint-0.2.7] Fix parsing bug with unecognized token at EOS
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit d978216dea6b21ac38230a59d172139185a68dbd Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:13:58 2016 -0500 Fix parsing bug with unecognized token at EOS In get_token(), we could read one byte past the end of the region. This is only a big problem in the case where the region itself is (a) potentially hostile, and (b) not explicitly nul-terminated. This patch fixes the underlying bug, and also makes sure that the one remaining case of not-NUL-terminated potentially hostile data gets NUL-terminated. Fix for bug 21018, TROVE-2016-12-002, and CVE-2016-1254 --- changes/bug21018 | 11 +++++++++++ src/or/routerparse.c | 6 +++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/changes/bug21018 b/changes/bug21018 new file mode 100644 index 0000000..49a8b47 --- /dev/null +++ b/changes/bug21018 @@ -0,0 +1,11 @@ + o Major bugfixes (parsing, security): + + - Fix a bug in parsing that could cause clients to read a single + byte past the end of an allocated region. This bug could be + used to cause hardened clients (built with + --enable-expensive-hardening) to crash if they tried to visit + a hostile hidden service. Non-hardened clients are only + affected depending on the details of their platform's memory + allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by + using libFuzzer. Also tracked as TROVE-2016-12-002 and as + CVE-2016-1254. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 176c16f..71373ce 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3857,7 +3857,7 @@ get_next_token(memarea_t *area, if (tok->tp == ERR_) { /* No keyword matched; call it an "K_opt" or "A_unrecognized" */ - if (**s == '@') + if (*s < eol && **s == '@') tok->tp = A_UNKNOWN_; else tok->tp = K_OPT; @@ -4863,7 +4863,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_free(cipher); len = ipos_encrypted_size - 2 - client_entries_len - CIPHER_IV_LEN; - dec = tor_malloc(len); + dec = tor_malloc_zero(len + 1); declen = crypto_cipher_decrypt_with_iv(session_key, dec, len, ipos_encrypted + 2 + client_entries_len, ipos_encrypted_size - 2 - client_entries_len); @@ -4895,7 +4895,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, "small."); return -1; } - dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); + dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1 + 1); declen = crypto_cipher_decrypt_with_iv(descriptor_cookie, dec, ipos_encrypted_size -

1 0

[tor/maint-0.2.6] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit b18bde23cf9c0afc95a83c3bfc7205218add4ddd Merge: 3d9f8ff db58d4d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:11:25 2016 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6 changes/bug21018 | 11 +++++++++++ src/or/rendcommon.c | 6 ++++-- src/or/routerparse.c | 6 +++--- 3 files changed, 18 insertions(+), 5 deletions(-)

1 0

[tor/maint-0.2.4] Make log message warn about detected attempts to exploit 21018.
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit 0fb3058eced5dce355d777288bd9ec255b875db4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:17:28 2016 -0500 Make log message warn about detected attempts to exploit 21018. --- src/or/rendcommon.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c index d1f8b1a..296df55 100644 --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@ -1327,8 +1327,10 @@ rend_cache_store_v2_desc_as_client(const char *desc, intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) {

1 0

[tor/maint-0.2.5] Make log message warn about detected attempts to exploit 21018.
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit 0fb3058eced5dce355d777288bd9ec255b875db4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:17:28 2016 -0500 Make log message warn about detected attempts to exploit 21018. --- src/or/rendcommon.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c index d1f8b1a..296df55 100644 --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@ -1327,8 +1327,10 @@ rend_cache_store_v2_desc_as_client(const char *desc, intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) {

1 0

[tor/maint-0.2.5] Fix parsing bug with unecognized token at EOS
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit d978216dea6b21ac38230a59d172139185a68dbd Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:13:58 2016 -0500 Fix parsing bug with unecognized token at EOS In get_token(), we could read one byte past the end of the region. This is only a big problem in the case where the region itself is (a) potentially hostile, and (b) not explicitly nul-terminated. This patch fixes the underlying bug, and also makes sure that the one remaining case of not-NUL-terminated potentially hostile data gets NUL-terminated. Fix for bug 21018, TROVE-2016-12-002, and CVE-2016-1254 --- changes/bug21018 | 11 +++++++++++ src/or/routerparse.c | 6 +++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/changes/bug21018 b/changes/bug21018 new file mode 100644 index 0000000..49a8b47 --- /dev/null +++ b/changes/bug21018 @@ -0,0 +1,11 @@ + o Major bugfixes (parsing, security): + + - Fix a bug in parsing that could cause clients to read a single + byte past the end of an allocated region. This bug could be + used to cause hardened clients (built with + --enable-expensive-hardening) to crash if they tried to visit + a hostile hidden service. Non-hardened clients are only + affected depending on the details of their platform's memory + allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by + using libFuzzer. Also tracked as TROVE-2016-12-002 and as + CVE-2016-1254. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 176c16f..71373ce 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3857,7 +3857,7 @@ get_next_token(memarea_t *area, if (tok->tp == ERR_) { /* No keyword matched; call it an "K_opt" or "A_unrecognized" */ - if (**s == '@') + if (*s < eol && **s == '@') tok->tp = A_UNKNOWN_; else tok->tp = K_OPT; @@ -4863,7 +4863,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_free(cipher); len = ipos_encrypted_size - 2 - client_entries_len - CIPHER_IV_LEN; - dec = tor_malloc(len); + dec = tor_malloc_zero(len + 1); declen = crypto_cipher_decrypt_with_iv(session_key, dec, len, ipos_encrypted + 2 + client_entries_len, ipos_encrypted_size - 2 - client_entries_len); @@ -4895,7 +4895,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, "small."); return -1; } - dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); + dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1 + 1); declen = crypto_cipher_decrypt_with_iv(descriptor_cookie, dec, ipos_encrypted_size -

1 0

[tor/maint-0.2.6] Make log message warn about detected attempts to exploit 21018.
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit 0fb3058eced5dce355d777288bd9ec255b875db4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:17:28 2016 -0500 Make log message warn about detected attempts to exploit 21018. --- src/or/rendcommon.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c index d1f8b1a..296df55 100644 --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@ -1327,8 +1327,10 @@ rend_cache_store_v2_desc_as_client(const char *desc, intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) {

1 0

[tor/maint-0.2.7] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit db58d4d16ff156b8827198b2732646c73eb59f14 Merge: 3d2d3f2 0fb3058 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:11:08 2016 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug21018 | 11 +++++++++++ src/or/rendcommon.c | 6 ++++-- src/or/routerparse.c | 6 +++--- 3 files changed, 18 insertions(+), 5 deletions(-) diff --cc src/or/rendcommon.c index bd701b2,296df55..9637d4d --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@@ -1113,8 -1327,11 +1113,10 @@@ rend_cache_store_v2_desc_as_client(cons intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); - retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) { log_warn(LD_REND, "Found too many introduction points on a hidden "

1 0

[tor/maint-0.2.4] Fix parsing bug with unecognized token at EOS
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit d978216dea6b21ac38230a59d172139185a68dbd Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:13:58 2016 -0500 Fix parsing bug with unecognized token at EOS In get_token(), we could read one byte past the end of the region. This is only a big problem in the case where the region itself is (a) potentially hostile, and (b) not explicitly nul-terminated. This patch fixes the underlying bug, and also makes sure that the one remaining case of not-NUL-terminated potentially hostile data gets NUL-terminated. Fix for bug 21018, TROVE-2016-12-002, and CVE-2016-1254 --- changes/bug21018 | 11 +++++++++++ src/or/routerparse.c | 6 +++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/changes/bug21018 b/changes/bug21018 new file mode 100644 index 0000000..49a8b47 --- /dev/null +++ b/changes/bug21018 @@ -0,0 +1,11 @@ + o Major bugfixes (parsing, security): + + - Fix a bug in parsing that could cause clients to read a single + byte past the end of an allocated region. This bug could be + used to cause hardened clients (built with + --enable-expensive-hardening) to crash if they tried to visit + a hostile hidden service. Non-hardened clients are only + affected depending on the details of their platform's memory + allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by + using libFuzzer. Also tracked as TROVE-2016-12-002 and as + CVE-2016-1254. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 176c16f..71373ce 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3857,7 +3857,7 @@ get_next_token(memarea_t *area, if (tok->tp == ERR_) { /* No keyword matched; call it an "K_opt" or "A_unrecognized" */ - if (**s == '@') + if (*s < eol && **s == '@') tok->tp = A_UNKNOWN_; else tok->tp = K_OPT; @@ -4863,7 +4863,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_free(cipher); len = ipos_encrypted_size - 2 - client_entries_len - CIPHER_IV_LEN; - dec = tor_malloc(len); + dec = tor_malloc_zero(len + 1); declen = crypto_cipher_decrypt_with_iv(session_key, dec, len, ipos_encrypted + 2 + client_entries_len, ipos_encrypted_size - 2 - client_entries_len); @@ -4895,7 +4895,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, "small."); return -1; } - dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); + dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1 + 1); declen = crypto_cipher_decrypt_with_iv(descriptor_cookie, dec, ipos_encrypted_size -

1 0

[tor/maint-0.2.7] Make log message warn about detected attempts to exploit 21018.
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit 0fb3058eced5dce355d777288bd9ec255b875db4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:17:28 2016 -0500 Make log message warn about detected attempts to exploit 21018. --- src/or/rendcommon.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c index d1f8b1a..296df55 100644 --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@ -1327,8 +1327,10 @@ rend_cache_store_v2_desc_as_client(const char *desc, intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) {

1 0