1591742 - DES IV buffer overread if IV is undersized

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Guido Vranken]

Attachment: pocdesiv.cpp

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0

Steps to reproduce:

See attached proof of concept.
Compile NSS with AddressSanitizer and this file for a clear indication of what's happening.

This bug was not fixed by the commits associated with https://bugzilla.mozilla.org/show_bug.cgi?id=1576307

Actual results:

The 'ivvec' vector is read beyond bounds in DES_InitContext() COPY8BTOHALF

Expected results:

No overread.

Comment 1

[Franziskus Kiefer [:franziskus]]

Attachment: Bug 1591742 - check des iv length and add test for it, r?jcj

Let's make sure the DES IV has the length we expect it to have.

Comment 2

[Daniel Veditz [:dveditz]]

"sec-other" for Firefox because we don't use DES, but maybe this is more severe for other NSS clients?

Comment 3

[Franziskus Kiefer [:franziskus]]

https://hg.mozilla.org/projects/nss/rev/35857ae98190c590ae00a01cb1a2ed48def3915f