1774654 - (CVE-2022-3479) tstclnt crashes when accessing gnutls server without a user cert in the database.

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P5)

Description

[Robert Relyea]

Attachment: nss-3.79-fix-client-cert-crash.patch

The patch for bug 1552254 contains an error where we check for a empty list, but the list is NULL. This can happen if the server requests a client auth cert, but the client has no certs in it's database. The crash happens in the default auth cert handler, which firefox overrides, so firefox does not have this issue, but other client applications (like tstclient) can crash. I'm including the upstream patch. I'll attach a phabricator patch shortly.

Comment 1

[Marko Kohtala]

Trivy reports a high CVE-2022-3479 for this.

Comment 2

[Joonas Niilola]

Even though the target milestone is tagged to 3.81, I don't see this fix even on 3.84. It would also be great to have an ESR release with this in, if possible. From a quick glance the codebase looks to match.

Comment 3

[Charles Robertson]

What is the plan to get this fixed?

Comment 4

[John Schanck [:jschanck]]

Bob can you submit your patch through phab? FWIW, I think the null check needs to be immediately after CERT_FindUserCertsByUsage, or we can crash in CERT_FilterCertListByCANames in the !chosenNickName case. Probably CERT_FilterCertListByCANames should also have a null check.

Comment 5

[Robert Relyea]

john, You are correct. The patch attached to this bug is old and incomplete. I have a better patch I'll push to fabricator.

Comment 6

[Robert Relyea]

Attachment: WIP: Bug 1774654 tstclnt crashes when accessing gnutls server without a user cert in the database.

The filter functions do not handle NULL CERTCertLists, but CERT_FindUserCertsByUsage can return a NULL cert list. If it returns a NULL list, we should just
fail at the point (there are no certs available).

Comment 7

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/a7f363511333b8062945557607691002fd6e40b9

Comment 8

[msirringhaus]

Shouldn't this also get uplifted to ESR?

Comment 9

[Robert Relyea]

It doesn't need to be. It doesn't affect Firefox. The code in question is a default get UserCert handler which isn't used by Firefox.

Comment 10

[msirringhaus]

The patch applies cleanly to ESR. We've patched the version ourselves now, so we're fine.

But I think in principle, NSS ESR is also supported standalone? Therefore it should also get all security fixes that don't affect Firefox.