2027388 - Heap buffer over-read in [@ pk11_HandUnwrap] (pk11skey.c:2665) reachable via public API PK11_UnwrapSymKey.

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Bugmon [:jkratzer for issues]]

Heap buffer over-read in pk11_HandUnwrap (pk11skey.c:2665) reachable via public API PK11_UnwrapSymKey.

ROOT CAUSE:
In pk11_HandUnwrap() at pk11skey.c:2628, a heap buffer is allocated sized to the INPUT wrapped-key length:
outKey.data = (unsigned char *)PORT_Alloc(inKey->len);

After decryption, at pk11skey.c:2665, the output length is set to the CALLER-SUPPLIED keySize with NO bounds check against the allocation size:
outKey.len = (key_size == 0) ? len : key_size;

This SECItem is then passed to pk11_ImportSymKeyWithTempl() which calls SECITEM_CopyItem() at pk11skey.c:455, performing a memcpy of outKey.len bytes from the undersized outKey.data buffer -> heap-buffer-overflow READ.

TRIGGER CONDITIONS:

1. C_UnwrapKey must fail with an error other than CKR_DEVICE_ERROR (triggers pk11_HandUnwrap fallback at pk11skey.c:2861). Easily achieved with a wrapping key that has CKA_DECRYPT=TRUE but CKA_UNWRAP=FALSE (or any PKCS#11 token that rejects the unwrap for any reason).
2. C_Decrypt must succeed on the wrapped blob.
3. keySize parameter > wrappedKey->len.

IMPACT:
Attacker-controlled out-of-bounds heap read of (keySize - wrappedKey->len) bytes. The over-read data is copied into symKey->data and also exposed via CKA_VALUE to the PKCS#11 module, enabling heap memory disclosure. Since keySize is fully caller-controlled (int), the over-read size is arbitrary up to INT_MAX.

REACHABILITY:
Reachable from public NSS APIs: PK11_UnwrapSymKey, PK11_UnwrapSymKeyWithFlags, PK11_UnwrapSymKeyWithFlagsPerm, PK11_PubUnwrapSymKey, PK11_PubUnwrapSymKeyWithMechanism, PK11_PubUnwrapSymKeyWithFlags, PK11_PubUnwrapSymKeyWithFlagsPerm — all of which take a caller-supplied keySize parameter that flows unchecked into pk11_HandUnwrap. Any NSS consumer that allows an attacker to influence the keySize parameter while using a token whose C_UnwrapKey can fail is affected.

ASAN CONFIRMATION:
ERROR: AddressSanitizer: heap-buffer-overflow READ of size 4096 at 0x5020000a6e60 (0 bytes after 16-byte region) in memcpy via SECITEM_CopyItem_Util -> pk11_ImportSymKeyWithTempl (pk11skey.c:455) -> pk11_HandUnwrap (pk11skey.c:2669) -> pk11_AnyUnwrapKey (pk11skey.c:2861) -> PK11_UnwrapSymKey (pk11skey.c:2877). Allocation site: PORT_Alloc in pk11_HandUnwrap (pk11skey.c:2628).

Comment 1

[Bugmon [:jkratzer for issues]]

Attachment: pk11_symkey_unittest.cc

Comment 2

[Bugmon [:jkratzer for issues]]

Attachment: crash_stack.txt

Comment 4

[Benjamin Beurdouche [:beurdouche]]

Attachment: (secure)

Comment 5

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 2027388 using build mozilla-central 20260328200338-8e941630524a. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 6

[John Schanck [:jschanck]]

@beurdouche can you set the severity?

Comment 7

[Dennis Jackson]

PKCS#11 is not a trust boundary.

Comment 8

[BugBot [:suhaib / :marco]]

There is an r+ patch which didn't land and no activity in this bug for 1 week.
:rrelyea, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/504321715ea3
Add defensive check on pk11_HandUnwrap key size r=nss-reviewers,rrelyea

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/62cff6341cc9
Backed out changeset 504321715ea3

Comment 11

[John Schanck [:jschanck]]

Attachment: (secure)

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/635e02b363fe
add defensive check on pk11_HandUnwrap key size. r=bbeurdouche,nss-reviewers