OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
openssl-library.org
OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
1–10 of 52 posts
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#2Can someone translate
"Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable"
to human?
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#3Can someone translate "Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable" to human?
[dead]
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#4Can someone translate "Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable" to human?
Services that process CMS[1] or PKCS#7 envelopes may be vulnerable to this bug. The most common example of these is S/MIME (for signed/encrypted email), but PKCS#7 and CMS show up in all kinds of random places.
(Unless I'm missing something, a key piece of context here is that CMD/PKCS#7 blobs are typically allowed to select their own algorithms, at least within an allowlist controlled by the receiving party. So the fact that it depends on an AEAD-specific parameter encoding is probably not a huge hurdle for someone looking to exploit this.)
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#5Can someone translate "Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable" to human?
PKCS7 is a container format that pops up in a couple places in the TLS ecosystem (also in code signing); anywhere you need a secure blob that includes metadata. It's a very widely used format.
AEAD ciphers are those that simultaneously encrypt and authenticate data. AES-GCM is the most popular; Chapoly is the 2nd most popular. AEAD ciphers are how modern programs do encryption.
AEAD ciphers all rely on additional parameters, most commonly a nonce; it's critical to security that the nonce only ever be used once with a given key. You need the nonce to decrypt the AEAD ciphertext, so it's usually tacked on to the message (in more clever formats you can derive it contextually, but PKCS7 is a general-purpose format).
In parsing PKCS7 messages, when OpenSSL comes across AEAD-encrypted blobs, it needs to parse out the nonce. AEAD nonces tend to have fixed sizes, but there are extended-nonce variants of AEADs, and the format allows for arbitrary-sized values. OpenSSL assumed a fixed nonce size, but parsed with a library that handled arbitrary-sized values. Stack overflow.
A maliciously formatted Authenticode signature, certificate chain, OCSP response (I think?), all things that could trigger the bug.
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#6[deleted]
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#72026 and we still have bugs from copying unbounded user input into fixed size stack buffers in security critical code. Oh well, maybe we'll fix it in the next 30 years instead.
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#8Is this really exploitable? Is stack smashing really still a thing on any modern platform?
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#9Is this really exploitable? Is stack smashing really still a thing on any modern platform?
I’ll answer to myself: an RCE is very unlikely on any modern platform. DoS is possible.
“ Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution.”
Re: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
#102026 and we still have bugs from copying unbounded user input into fixed size stack buffers in security critical code. Oh well, maybe we'll fix it in the next 30 years instead.
2026 and why not vibe code our own cryptography library just like we are vibing lots of sandbox solutions? /s