Bug 1228611 (CVE-2014-8176)

Summary: CVE-2014-8176 OpenSSL: Invalid free in DTLS
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: cdewolf, csutherl, dandread, darran.lofthouse, gzaronik, jason.greene, jawilson, jboss-set, jclere, jdoyle, lgao, mbabacek, mturk, myarboro, pgier, pslavice, rsvoboda, security-response-team, szidek, tmraz, twalsh, vtunka, weli
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
See Also: https://issues.redhat.com/browse/JBCS-44
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
An invalid-free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could send a specially crafted message to the peer, which could cause the application to crash or potentially result in arbitrary code execution.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:41:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1228618, 1228619, 1228620, 1228621, 1231051, 1242976, 1242977, 1242978, 1242979    
Bug Blocks: 1227577, 1395463    

Description Huzaifa S. Sidhpurwala 2015-06-05 10:23:49 UTC 
The following was reported by OpenSSL upstream:

This vulnerability does not affect current versions of OpenSSL. It existed in previous OpenSSL versions and was fixed in June 2014.

If a DTLS peer receives application data between the ChangeCipherSpec and Finished messages, buffering of such data may cause an invalid free, resulting in a segmentation fault or potentially, memory corruption.

This issue affected older OpenSSL versions 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 0.9.8 DTLS users should upgrade to 0.9.8za
OpenSSL 1.0.0 DTLS users should upgrade to 1.0.0m.
OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1h.

This issue was originally reported on March 28th 2014 in https://rt.openssl.org/Ticket/Display.html?id=3286 by Praveen Kariyanahalli, and subsequently by Ivan Fratric and Felix Groebert (Google). A fix was developed by zhu qun-ying.


Acknowledgements:

Red Hat would like to thank the OpenSSL project for reporting this issue.
Comment 1 Huzaifa S. Sidhpurwala 2015-06-05 10:39:16 UTC 
Upstream patches:

OpenSSL-1.0.1:
https://github.com/openssl/openssl/commit/bcc31166

OpenSSL-0.9.8:
https://github.com/openssl/openssl/commit/4b258e73
Comment 3 Huzaifa S. Sidhpurwala 2015-06-12 04:18:40 UTC 
Reference:

https://www.openssl.org/news/secadv_20150611.txt
Comment 4 Huzaifa S. Sidhpurwala 2015-06-12 05:56:15 UTC 
Created openssl tracking bugs for this issue:

Affects: fedora-all [bug 1231051]
Comment 5 errata-xmlrpc 2015-06-15 20:49:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2015:1115 https://rhn.redhat.com/errata/RHSA-2015-1115.html
Comment 6 Huzaifa S. Sidhpurwala 2015-06-16 01:36:24 UTC 
Statement:

This issue does NOT affect the version of OpenSSL package as shipped with Red Hat Enterprise Linux 5.
Comment 13 errata-xmlrpc 2016-12-15 22:14:32 UTC 
This issue has been addressed in the following products:



Via RHSA-2016:2957 https://rhn.redhat.com/errata/RHSA-2016-2957.html