1359963 - NSS server crash when handling SSLv2 hello, attempt to write to NULL buffer.

Status: RESOLVED DUPLICATE of bug 1328122

(NSS :: Libraries, enhancement)

Description

[Kai Engert [:KaiE:]]

We've received a report from a user of a server software that uses NSS.

The report was seen on a RHEL 7.3 system, with NSS 3.28.2, in combination with an old nss-softokn 3.16.2.3

It's crashing in ssl3_GatherData, here:
    if (v2HdrLength) {
        gs->inbuf.len = 5 - v2HdrLength;
->      PORT_Memcpy(lbp, gs->hdr + v2HdrLength, gs->inbuf.len);
        gs->remainder -= gs->inbuf.len;
        lbp += gs->inbuf.len;
    }

lbp is NULL, apparently the code expects that a destination buffer was allocated, but it hasn't.

Comment 1

[Kai Engert [:KaiE:]]

Attachment: stacktrace.1490284479.txt

attaching full stack

Comment 2

[Kai Engert [:KaiE:]]

Additional information, the crash was triggered by running a Qualys vulnerability scan on the server.

Based on the stack, it seems a SSLv2 compatible hello was sent to the crashing server.

Comment 3

[Kai Engert [:KaiE:]]

For reference:
https://bugzilla.redhat.com/show_bug.cgi?id=1435017

(There are private comments which you probably aren't able to see.)

Comment 4

[Martin Thomson [:mt:]]

Note that the code on trunk asserts that lbp is non-NULL, so there is probably already a fix added.  Tim knows this code better than I do, but it seems like you might just be able to backport the fix to Bug 1328122 (https://hg.mozilla.org/projects/nss/rev/55ea60effd0d).

Comment 5

[Tim Taubert [:ttaubert] (inactive)]

Martin is right, we can backport the fix for bug 1328122 if needed. OTOH, 3.29 has it already and only servers are affected.

Comment 6

[Huzaifa Sidhpurwala]

Does Mozilla intend to assign a CVE id to this issue, or should we do it?

Comment 7

[Huzaifa Sidhpurwala]

any thing on comment #6 yet?

Comment 8

[Huzaifa Sidhpurwala]

We have assigned CVE-2017-7502 to this issue.

Comment 9

[Tim Taubert [:ttaubert] (inactive)]

Thanks!

Comment 10

[Daniel Veditz [:dveditz]]

So is this a dupe of bug 1328122 then? If it's the same CVE number and same patch seems like it is.

Comment 11

[Tim Taubert [:ttaubert] (inactive)]

Yeah.