Bug 1771988 - SoftHSM makes openssl to crash on exit
Summary: SoftHSM makes openssl to crash on exit
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: softhsm
Version: 30
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Paul Wouters
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-11-13 10:50 UTC by Anderson Sasaki
Modified: 2020-04-27 15:28 UTC (History)
2 users (show)

Fixed In Version: softhsm-2.6.0-1.fc33
Clone Of:
Environment:
Last Closed: 2020-04-27 15:28:45 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Anderson Sasaki 2019-11-13 10:50:11 UTC
Description of problem:
SoftHSM does not correctly reset its state after running the destructor, causing OpenSSL to re-try to deallocate already freed memory causing a crash.

This happens when running OpenSSL + openssl-pkcs11 engine and SoftHSM.

Version-Release number of selected component (if applicable):
softhsm-2.5.0-3.fc30.1.x86_64
openssl-pkcs11-0.4.10-3.fc32.x86_64
openssl-1.1.1d-2.fc30.x86_64

How reproducible:
always

Steps to Reproduce:
1. Setup a Softhsm device containing a private key

2. Request a signature of a file using openssl and provide a *wrong pin*

$ openssl pkeyutl -engine pkcs11 -keyform engine -inkey "pkcs11:token=softhsm;object=test;type=private" -sign -out signature -in input_file

Actual results:
engine "pkcs11" set.
Enter PKCS#11 token PIN for softhsm:
Login failed
Login to token failed, returning NULL...
PKCS11_get_private_key returned NULL
cannot load Private Key from engine
140485847750464:error:820740A0:PKCS#11 module:pkcs11_login:PIN incorrect:p11_slot.c:240:
140485847750464:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:crypto/engine/eng_pkey.c:77:
unable to load Private Key
pkeyutl: Error initializing context
free(): double free detected in tcache 2
Aborted (core dumped)

Expected results:
Same error messages but without double free and core dump at the end.

Additional info:
There is a proposed fix upstream: https://github.com/opendnssec/SoftHSMv2/pull/503


Note You need to log in before you can comment on or make changes to this bug.