1861033 - Heap Buffer Overflow ASAN Crash in AES_InitContext when calling PK11_CreateContextBySymKey with CKM_AES_CBC_PAD

Status: RESOLVED INVALID

(NSS :: Libraries, defect)

Description

[Noah Lokocz]

Attachment: crash-c24cc1ffe41e72b3520d45307c8ff83f80ee54ef

+++ This bug was initially created as a clone of Bug #1861015 +++

One of the fuzzing runs of this fuzzer leads to an Unknown Address ASAN crash within sftk_CryptInit when the CK_MECHANISM CKM_CHACHA20 is used. The crash unit for the fuzzing run causing the crash is attached.

ASAN/Fuzzer output:
==41607==ERROR: AddressSanitizer: SEGV on unknown address 0x000001010000 (pc 0x000100e671d8 bp 0x00016f2363a0 sp 0x00016f236100 T0)
==41607==The signal is caused by a READ memory access.
#0 0x100e671d8 in sftk_CryptInit pkcs11c.c:1390
#1 0x100e6aa64 in NSC_EncryptInit pkcs11c.c:1457
#2 0x100d6380c in pk11_context_init pk11cxt.c:206
#3 0x100d5ec70 in pk11_CreateNewContextInSlot pk11cxt.c:428
#4 0x100d5e488 in PK11_CreateContextBySymKey pk11cxt.c:510
#5 0x100bcb0cc in LLVMFuzzerTestOneInput nssfuzz-NSC_EncryptUpdate_DecryptUpdate.cc:113
#6 0x1011b2cc8 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) FuzzerLoop.cpp:614
#7 0x1011b25b0 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) FuzzerLoop.cpp:516
#8 0x1011b3cfc in fuzzer::Fuzzer::MutateAndTestOne() FuzzerLoop.cpp:760
#9 0x1011b4b3c in fuzzer::Fuzzer::Loop(std::__1::vector<fuzzer::SizedFile, std::__1::allocator<fuzzer::SizedFile>>&) FuzzerLoop.cpp:905
#10 0x1011a46f0 in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) FuzzerDriver.cpp:911
#11 0x1011ce810 in main FuzzerMain.cpp:20
#12 0x18b655054 (<unknown module>)
#13 0xe31bfffffffffffc (<unknown module>)

==41607==Register values:
x[0] = 0x0000000001010000 x[1] = 0x0000000000000004 x[2] = 0x0000000000000000 x[3] = 0x000060400004a7b0
x[4] = 0x000060400004a7c0 x[5] = 0x0000000000000000 x[6] = 0x0700ff09000000a8 x[7] = 0x0000000000000001
x[8] = 0x0000000000000000 x[9] = 0x0000000000000000 x[10] = 0x0000000101583e00 x[11] = 0x0000000200000000
x[12] = 0x0000000000001780 x[13] = 0x0000000000000002 x[14] = 0x0000000000000001 x[15] = 0x00007fffffffffff
x[16] = 0x000000018b9fd650 x[17] = 0x00000001e2c95300 x[18] = 0x0000000000000000 x[19] = 0x000000016f236280
x[20] = 0x0000007000020000 x[21] = 0x0000000001010000 x[22] = 0x000000702de66c20 x[23] = 0x0000000000000000
x[24] = 0x000060400004a7bc x[25] = 0x0000000000000000 x[26] = 0x000000010151c000 x[27] = 0x00000c08000094f7
x[28] = 0x0000000000000004 fp = 0x000000016f2363a0 lr = 0x0000000100e67178 sp = 0x000000016f236100
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV pkcs11c.c:1390 in sftk_CryptInit
==41607==ABORTING
MS: 1 CopyPart-; base unit: 00254de278412e81ba3ee65550e03831e3651775
0x20,0x0,0x0,0x1,0x1,0x0,0x0,0x0,0x0,0x20,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0xf,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x20,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x9,0xff,0x0,0x7,0x0,0x0,0x0,0x0,0x0,0x0,0x75,0x0,0x1,0x0,0xa8,0x0,0x0,0x0,0x9,0xff,0x0,0x7,0x0,0xef,
\000\000\001\001\000\000\000\000 \000\000\000\000\000\000\000\000\000\000\000\000\017\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000\000\000\011\377\000\007\000\000\000\000\000\000u\000\001\000\250\000\000\000\011\377\000\007\000\357
artifact_prefix='./'; Test unit written to ./crash-c24cc1ffe41e72b3520d45307c8ff83f80ee54ef
Base64: IAAAAQEAAAAAIAAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAn/AAcAAAAAAAB1AAEAqAAAAAn/AAcA7w==
zsh: abort ./nssfuzz-NSC_EncryptUpdate_DecryptUpdate

Comment 1

[Noah Lokocz]

Attachment: WIP: Bug 1861033 - PK11_CipherOp Fuzzer for the CKM_CHACHA20 mechanism