5 ms·

I don't see this function called anywhere in the OpenSSL source, or, for instance, the Apache source code. Could you clarify on this post? EDIT: I see it expos

by chomp 13y ago

I don't see this function called anywhere in the OpenSSL source, or, for instance, the Apache source code. Could you clarify on this post? EDIT: I see it exposed in 0.9.8y. Anyone know of anything that builds against this specifically and uses it?

deleted 13y ago
[deleted]
pipeep 13y ago
Seeing as it's static, it's not part of the public API. Apparently it was used in Ruby at one point: https://groups.google.com/forum/#!topic/mailing.openssl.dev/7kcdEa5lpLI https://groups.google.com/forum/#!topic/mailing.openssl.dev/... I think it's probably a piece of dead code at this point, but there might be some legacy stuff using it (with an old version of OpenSSL), which could lead to a vulnerability. Regardless, the function should probably be rewritten or removed. EDIT: It looks like the latest version of Ruby (MRI) actually copied this function from OpenSSL so they could keep using it: https://github.com/ruby/ruby/blob/1aa54bebaf274bc08e72f9ad3854c7ad592c344a/ext/openssl/ossl_ssl_session.c#L76 https://github.com/ruby/ruby/blob/1aa54bebaf274bc08e72f9ad38...
- chomp 13y ago
  Yeah, I'm thinking it's dead code. It's not exposed in modern OpenSSLs, and I can't find any services we use (Pure-FTP, httpd, etc) that use this function. OpenSSL devs should probably remove this code.
  - pipeep 13y ago
    It looks like there's some github projects using it: https://github.com/search?q=SSL_SESSION_cmp&ref=cmdform&type=Code https://github.com/search?q=SSL_SESSION_cmp&ref=cmdform&type...
- pipeep 13y ago
  I made a patch to ruby swapping the memcmp for CRYPTO_memcmp, which should be constant-time. I'm checking to see that I didn't break the build, after which I'll make a pull request to https://github.com/ruby/ruby https://github.com/ruby/ruby. Then it'll be up to the ruby developers, who probably have better insight into this than me, to accept or decline it. EDIT: For anyone interested: https://github.com/ruby/ruby/pull/591 https://github.com/ruby/ruby/pull/591
- petermalone 13y ago
  The current version of Android also uses it.
  - pipeep 13y ago
    Link?
    - petermalone 13y ago
      https://android.googlesource.com/platform/external/openssl/+/android-4.4.2_r2/ssl/ssl_lib.c https://android.googlesource.com/platform/external/openssl/+...
      - pipeep 13y ago
        It's marked as static and isn't used anywhere there, so it's not an issue: they have an up-to-date version of upstream OpenSSL.
        petermalone 13y ago
        Ah - good to know. Cheers!
duskwuff 13y ago
Even if it were used, how large is a SSL_SESSION, and does a client have any control over its contents? Not every memcmp() is necessarily vulnerable.
- jas203 13y ago
  Session IDs themselves are public; namely they may be exchanged in the plain text as part of an initial TLS handshake. They are used for session resumption to look-up confidential (e.g. keying) information that should be stored in a protected manner by the TLS peers.
  - duskwuff 13y ago
    Given that the session ID is exchanged in plaintext, I'm definitely not seeing the security risk here. At best, you could potentially use a timing attack to recover the contents of a session ID, but you can already get that by sniffing the network. And in any case, even if you did get that, I don't think there's anything interesting you could do with it.
    - jas203 13y ago
      That is my point.
mbell 13y ago
> EDIT: I see it exposed in 0.9.8y. Anyone know of anything that builds against this specifically and uses it? I don't know of anything that builds against that version specifically but it is the version that is included in OS X as of 10.9 (and possibly 10.8).

by chomp 13y ago

deleted 13y ago

[deleted]

pipeep 13y ago

Seeing as it's static, it's not part of the public API. Apparently it was used in Ruby at one point: https://groups.google.com/forum/#!topic/mailing.openssl.dev/7kcdEa5lpLI https://groups.google.com/forum/#!topic/mailing.openssl.dev/... I think it's probably a piece of dead code at this point, but there might be some legacy stuff using it (with an old version of OpenSSL), which could lead to a vulnerability. Regardless, the function should probably be rewritten or removed. EDIT: It looks like the latest version of Ruby (MRI) actually copied this function from OpenSSL so they could keep using it: https://github.com/ruby/ruby/blob/1aa54bebaf274bc08e72f9ad3854c7ad592c344a/ext/openssl/ossl_ssl_session.c#L76 https://github.com/ruby/ruby/blob/1aa54bebaf274bc08e72f9ad38...

chomp 13y ago
Yeah, I'm thinking it's dead code. It's not exposed in modern OpenSSLs, and I can't find any services we use (Pure-FTP, httpd, etc) that use this function. OpenSSL devs should probably remove this code.
- pipeep 13y ago
  It looks like there's some github projects using it: https://github.com/search?q=SSL_SESSION_cmp&ref=cmdform&type=Code https://github.com/search?q=SSL_SESSION_cmp&ref=cmdform&type...
pipeep 13y ago
I made a patch to ruby swapping the memcmp for CRYPTO_memcmp, which should be constant-time. I'm checking to see that I didn't break the build, after which I'll make a pull request to https://github.com/ruby/ruby https://github.com/ruby/ruby. Then it'll be up to the ruby developers, who probably have better insight into this than me, to accept or decline it. EDIT: For anyone interested: https://github.com/ruby/ruby/pull/591 https://github.com/ruby/ruby/pull/591
petermalone 13y ago
The current version of Android also uses it.
- pipeep 13y ago
  Link?
  - petermalone 13y ago
    https://android.googlesource.com/platform/external/openssl/+/android-4.4.2_r2/ssl/ssl_lib.c https://android.googlesource.com/platform/external/openssl/+...
    - pipeep 13y ago
      It's marked as static and isn't used anywhere there, so it's not an issue: they have an up-to-date version of upstream OpenSSL.
      - petermalone 13y ago
        Ah - good to know. Cheers!

duskwuff 13y ago

Even if it were used, how large is a SSL_SESSION, and does a client have any control over its contents? Not every memcmp() is necessarily vulnerable.

jas203 13y ago
Session IDs themselves are public; namely they may be exchanged in the plain text as part of an initial TLS handshake. They are used for session resumption to look-up confidential (e.g. keying) information that should be stored in a protected manner by the TLS peers.
- duskwuff 13y ago
  Given that the session ID is exchanged in plaintext, I'm definitely not seeing the security risk here. At best, you could potentially use a timing attack to recover the contents of a session ID, but you can already get that by sniffing the network. And in any case, even if you did get that, I don't think there's anything interesting you could do with it.
  - jas203 13y ago
    That is my point.

mbell 13y ago

> EDIT: I see it exposed in 0.9.8y. Anyone know of anything that builds against this specifically and uses it? I don't know of anything that builds against that version specifically but it is the version that is included in OS X as of 10.9 (and possibly 10.8).