Bug 1421695 (CVE-2017-3733)

Summary: CVE-2017-3733 openssl: Encrypt-Then-Mac renegotiation crash
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: sardella, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: openssl 1.1.0e Doc Type: If docs needed, set a value
Doc Text:
It was found that changing the ciphersuite during a renegotiation of the Encrypt-Then-Mac extension could result in a crash of the OpenSSL server or client.
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-02-13 13:14:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
CVE-2017-3733 patch none

Description Martin Prpič 2017-02-13 13:12:40 UTC
The following flaw was reported by OpenSSL upstream:

During a renegotiation handshake if the Encrypt-Then-Mac (ETM) extension is negotiated where it was not in the original handshake (or vice-versa) then this
can cause OpenSSL to crash (dependant on ciphersuite). Both clients and servers are affected.

The problem was caused by changing the flag indicating whether to use ETM or not immediately on negotiation of ETM, rather than at CCS. Therefore, during a renegotiation, if the ETM state is changing (usually due to a change of ciphersuite), then an error/crash will occur. Due to the fact that there are separate CCS messages for read and write we actually now need two flags to determine whether to use ETM or not.

This issue affects OpenSSL 1.1.0 only, and is fixed in 1.1.0e. This issue does not affect OpenSSL version 1.0.2.

Comment 1 Martin Prpič 2017-02-13 13:12:45 UTC
External References:

https://www.openssl.org/news/secadv/20170216.txt

Comment 2 Martin Prpič 2017-02-13 13:12:47 UTC
Acknowledgments:

Name: the OpenSSL project
Upstream: Joe Orton (Red Hat)

Comment 3 Martin Prpič 2017-02-13 13:13:27 UTC
Created attachment 1249850 [details]
CVE-2017-3733 patch

Comment 4 Andrej Nemec 2017-02-16 13:53:34 UTC
Public via:

https://www.openssl.org/news/vulnerabilities.html