From e70e34d857d4003199bcb5d3b52ca8102ccc1b98 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Mon, 5 Aug 2024 17:54:14 +0200 Subject: [PATCH] dh_kmgmt.c: Avoid expensive public key validation for known safe-prime groups MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The partial validation is fully sufficient to check the key validity. Thanks to Szilárd Pfeiffer for reporting the issue. Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/25088) CVE: CVE-2024-41996 Upstream-Status: Backport [https://github.com/openssl/openssl/commit/e70e34d857d4003199bcb5d3b52ca8102ccc1b98] Signed-off-by: Archana Polampalli --- providers/implementations/keymgmt/dh_kmgmt.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/providers/implementations/keymgmt/dh_kmgmt.c b/providers/implementations/keymgmt/dh_kmgmt.c index 795a3f2..3e7a811 100644 --- a/providers/implementations/keymgmt/dh_kmgmt.c +++ b/providers/implementations/keymgmt/dh_kmgmt.c @@ -387,9 +387,11 @@ static int dh_validate_public(const DH *dh, int checktype) if (pub_key == NULL) return 0; - /* The partial test is only valid for named group's with q = (p - 1) / 2 */ - if (checktype == OSSL_KEYMGMT_VALIDATE_QUICK_CHECK - && ossl_dh_is_named_safe_prime_group(dh)) + /* + * The partial test is only valid for named group's with q = (p - 1) / 2 + * but for that case it is also fully sufficient to check the key validity. + */ + if (ossl_dh_is_named_safe_prime_group(dh)) return ossl_dh_check_pub_key_partial(dh, pub_key, &res); return DH_check_pub_key_ex(dh, pub_key); -- 2.40.0