psa_generate_key for a symmetric key of ≥1025 bytes causes a double free #207

New issue

Closed

opened 2019-08-07 06:43:17 -05:00 by gilles-peskine-arm · 2 comments

gilles-peskine-arm commented

2019-08-07 06:43:17 -05:00

(Migrated from github.com)

Description

Steps to reproduce: on the psa-api-1.0-beta branch, call psa_generate_key() with any symmetric key type that allows large key sizes (e.g. PSA_KEY_TYPE_RAW, PSA_KEY_TYPE_HMAC, PSA_KEY_TYPE_DERIVE) and a size of 8200 bits or more (>1024 bytes). This causes a double free inside psa_generate_key.

Impacted product: This only affects the psa-api-1.0-branch, the offending code has never been merged to the Mbed Crypto development branch and thus this does not affect any Mbed Crypto release. The bug was introduced in #263, merged on 2019-05-03, earliest tag psa-api-1.0-beta3.

Impact: this is a double free(), so it can lead to arbitrary code execution. However, the exploitability is low, possibly nonexistent in single-threaded applications with many free() implementations, because there is only a very short window of time between the two free() calls, with no other call to malloc or free in between in the same thread.

Affected applications: The bug is triggered by a failure of psa_generate_random during key generation for a symmetric key (e.g. HMAC or derive, but not asymmetric keys such as RSA). This can happen in two ways:

If the key size is 1025 bytes or more, due to #206.
If the CTR_DRBG generator needs reseeding and the entropy source(s) fail, causing reseeding to fail. By default, the reseed interval for CTR_DRBG in Mbed Crypto is 10000 bytes. (Note that this is the total number of bytes generated internally, which is typically larger than the total number of bytes requested because CTR_DRBG generates a whole new block even when less than one block is requested.)

Issue request type

[ ] Question
[ ] Enhancement
[x] Bug

### Description Steps to reproduce: on the [psa-api-1.0-beta](https://github.com/ARMmbed/mbed-crypto/tree/psa-api-1.0-beta) branch, call `psa_generate_key()` with any symmetric key type that allows large key sizes (e.g. `PSA_KEY_TYPE_RAW`, `PSA_KEY_TYPE_HMAC`, `PSA_KEY_TYPE_DERIVE`) and a size of 8200 bits or more (>1024 bytes). This causes a double `free` inside `psa_generate_key`. Impacted product: This **only affects the psa-api-1.0-branch**, the offending code has never been merged to the Mbed Crypto `development` branch and thus this does not affect any Mbed Crypto release. The bug was introduced in #263, merged on 2019-05-03, earliest tag [psa-api-1.0-beta3](https://github.com/ARMmbed/mbed-crypto/tree/psa-api-1.0-beta3). Impact: this is a double free(), so it can lead to arbitrary code execution. However, the exploitability is low, possibly nonexistent in single-threaded applications with many free() implementations, because there is only a very short window of time between the two free() calls, with no other call to `malloc` or `free` in between in the same thread. Affected applications: The bug is triggered by a failure of `psa_generate_random` during key generation for a symmetric key (e.g. HMAC or derive, but not asymmetric keys such as RSA). This can happen in two ways: * If the key size is 1025 bytes or more, due to #206. * If the CTR_DRBG generator needs reseeding and the entropy source(s) fail, causing reseeding to fail. By default, the reseed interval for CTR_DRBG in Mbed Crypto is 10000 bytes. (Note that this is the total number of bytes generated internally, which is typically larger than the total number of bytes requested because CTR_DRBG generates a whole new block even when less than one block is requested.) ### Issue request type [ ] Question [ ] Enhancement [x] Bug

ciarmcom commented

2019-08-07 07:23:28 -05:00

(Migrated from github.com)

Internal Jira reference: https://jira.arm.com/browse/IOTCRYPT-855

*Internal Jira reference: https://jira.arm.com/browse/IOTCRYPT-855*

gilles-peskine-arm commented

2019-08-08 03:23:31 -05:00

(Migrated from github.com)

Fixed — https://github.com/ARMmbed/mbed-crypto/pull/197 fixes this and is now merged to psa-api-1.0-beta, which is the sole medium-term branch that had this bug,

**Fixed** — https://github.com/ARMmbed/mbed-crypto/pull/197 fixes this and is now merged to psa-api-1.0-beta, which is the sole medium-term branch that had this bug,