[Midnightbsd-cvs] [MidnightBSD/src] 08a555: OpenSSL: fix AES-WRAP-PAD heap overflow, cap buffe...

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 08a555214df08ebd870f68da212a0f10e63c6b36
      https://github.com/MidnightBSD/src/commit/08a555214df08ebd870f68da212a0f10e63c6b36
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M UPDATING
    M crypto/openssl/crypto/cms/cms_kari.c
    M crypto/openssl/ssl/record/rec_layer_d1.c
    M crypto/openssl/ssl/record/record_local.h
    M crypto/openssl/ssl/record/ssl3_record.c

  Log Message:
  -----------
  OpenSSL: fix AES-WRAP-PAD heap overflow, cap buffered DTLS records

Backport two fixes from OpenSSL 3.0.22 to the 1.1.1 branch, which is
end of life upstream and only receives these fixes in a premium support
release.

cms_kek_cipher() allocated its output buffer using the output length
reported by EVP_CipherUpdate(), but on its integrity-failure paths the
AES-WRAP-PAD primitive writes and cleanses up to the input length,
giving an 8 byte out-of-bounds heap write reachable through CMS key
unwrapping.  Size the buffer for that worst case.  [CVE-2026-63072]

dtls1_buffer_record() capped each of its three queues at 100 entries,
each holding an entire read buffer.  A peer can send a stream of tiny
next-epoch records and force disproportionate heap use.  Upstream both
stopped taking the whole read buffer and lowered the next-epoch queue
limit; take the limit change here, which needs no rework of the record
layer: dtls1_buffer_record() now takes the limit as an argument and the
unprocessed_rcds queue passes 16 rather than 100.  The other two queues
are unchanged - processed_rcds is filled from unprocessed_rcds and so
cannot exceed it, and buffered_app_data holds real application data.
This bounds the amplification rather than eliminating it.
[CVE-2026-54874, partial]

The remaining CVEs in FreeBSD-SA-26:61.openssl do not apply to 1.1.1:
the CMP issues (CVE-2026-63073, CVE-2026-63074, CVE-2026-63076) need
code that 1.1.1 does not have, the QUIC and raw public key issues
(CVE-2026-14457, CVE-2026-18798, CVE-2026-63075) are 3.4 and later, and
CVE-2026-75803 is 3.0 and later.

Obtained from:	OpenSSL (3.0.22)
Signed-off-by: Lucas Holt <luke at foolishgames.com>
AI-Assisted-by: Claude Opus 5



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications