diff options
Diffstat (limited to 'backport-0001-release-branch.go1.21-crypto-x509-make-sure-pub-key-.patch')
| -rw-r--r-- | backport-0001-release-branch.go1.21-crypto-x509-make-sure-pub-key-.patch | 78 |
1 files changed, 78 insertions, 0 deletions
diff --git a/backport-0001-release-branch.go1.21-crypto-x509-make-sure-pub-key-.patch b/backport-0001-release-branch.go1.21-crypto-x509-make-sure-pub-key-.patch new file mode 100644 index 0000000..7ee3178 --- /dev/null +++ b/backport-0001-release-branch.go1.21-crypto-x509-make-sure-pub-key-.patch @@ -0,0 +1,78 @@ +From 5dfc2e6c42724349a9e9ecbcc69be920c18d90e9 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker <bracewell@google.com> +Date: Thu, 18 Jan 2024 12:51:13 -0800 +Subject: [PATCH 1/4] [release-branch.go1.21] crypto/x509: make sure pub key is + non-nil before interface conversion + +alreadyInChain assumes all keys fit a interface which contains the +Equal method (which they do), but this ignores that certificates may +have a nil key when PublicKeyAlgorithm is UnknownPublicKeyAlgorithm. In +this case alreadyInChain panics. + +Check that the key is non-nil as part of considerCandidate (we are never +going to build a chain containing UnknownPublicKeyAlgorithm anyway). + +For #65390 +Fixes #65392 +Fixes CVE-2024-24783 + +Change-Id: Ibdccc0a487e3368b6812be35daad2512220243f3 +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2137282 +Reviewed-by: Damien Neil <dneil@google.com> +Run-TryBot: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Tatiana Bradley <tatianabradley@google.com> +Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2173774 +Reviewed-by: Roland Shoemaker <bracewell@google.com> +Reviewed-by: Carlos Amedee <amedee@google.com> +Reviewed-on: https://go-review.googlesource.com/c/go/+/569238 +Auto-Submit: Michael Knyszek <mknyszek@google.com> +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> +Reviewed-by: Carlos Amedee <carlos@golang.org> +--- + src/crypto/x509/verify.go | 2 +- + src/crypto/x509/verify_test.go | 19 +++++++++++++++++++ + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go +index 345d434453c..56a1a1725cc 100644 +--- a/src/crypto/x509/verify.go ++++ b/src/crypto/x509/verify.go +@@ -899,7 +899,7 @@ func (c *Certificate) buildChains(currentChain []*Certificate, sigChecks *int, o + ) + + considerCandidate := func(certType int, candidate *Certificate) { +- if alreadyInChain(candidate, currentChain) { ++ if candidate.PublicKey == nil || alreadyInChain(candidate, currentChain) { + return + } + +diff --git a/src/crypto/x509/verify_test.go b/src/crypto/x509/verify_test.go +index 3551b470ced..d8678d03f93 100644 +--- a/src/crypto/x509/verify_test.go ++++ b/src/crypto/x509/verify_test.go +@@ -2693,3 +2693,22 @@ func TestVerifyEKURootAsLeaf(t *testing.T) { + } + + } ++ ++func TestVerifyNilPubKey(t *testing.T) { ++ c := &Certificate{ ++ RawIssuer: []byte{1, 2, 3}, ++ AuthorityKeyId: []byte{1, 2, 3}, ++ } ++ opts := &VerifyOptions{} ++ opts.Roots = NewCertPool() ++ r := &Certificate{ ++ RawSubject: []byte{1, 2, 3}, ++ SubjectKeyId: []byte{1, 2, 3}, ++ } ++ opts.Roots.AddCert(r) ++ ++ _, err := c.buildChains([]*Certificate{r}, nil, opts) ++ if _, ok := err.(UnknownAuthorityError); !ok { ++ t.Fatalf("buildChains returned unexpected error, got: %v, want %v", err, UnknownAuthorityError{}) ++ } ++} +-- +2.33.0 + |