80 lines
2.8 KiB
Diff
80 lines
2.8 KiB
Diff
From 1d72429c37a1b3841d02b95a1aaa2d8c0f0e88d1 Mon Sep 17 00:00:00 2001
|
|
From: Roland Shoemaker <bracewell@google.com>
|
|
Date: Thu, 18 Jan 2024 12:51:13 -0800
|
|
Subject: [PATCH 1/4] [release-branch.go1.21] crypto/x509: make sure pub key is
|
|
non-nil before interface conversion
|
|
|
|
alreadyInChain assumes all keys fit a interface which contains the
|
|
Equal method (which they do), but this ignores that certificates may
|
|
have a nil key when PublicKeyAlgorithm is UnknownPublicKeyAlgorithm. In
|
|
this case alreadyInChain panics.
|
|
|
|
Check that the key is non-nil as part of considerCandidate (we are never
|
|
going to build a chain containing UnknownPublicKeyAlgorithm anyway).
|
|
|
|
For #65390
|
|
Fixes #65392
|
|
Fixes CVE-2024-24783
|
|
|
|
Change-Id: Ibdccc0a487e3368b6812be35daad2512220243f3
|
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2137282
|
|
Reviewed-by: Damien Neil <dneil@google.com>
|
|
Run-TryBot: Roland Shoemaker <bracewell@google.com>
|
|
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
|
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2173774
|
|
Reviewed-by: Roland Shoemaker <bracewell@google.com>
|
|
Reviewed-by: Carlos Amedee <amedee@google.com>
|
|
Reviewed-on: https://go-review.googlesource.com/c/go/+/569238
|
|
Auto-Submit: Michael Knyszek <mknyszek@google.com>
|
|
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
|
|
Reviewed-by: Carlos Amedee <carlos@golang.org>
|
|
---
|
|
src/crypto/x509/verify.go | 3 +++
|
|
src/crypto/x509/verify_test.go | 19 +++++++++++++++++++
|
|
2 files changed, 22 insertions(+)
|
|
|
|
diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go
|
|
index cb8d8f872dd..896df33d09f 100644
|
|
--- a/src/crypto/x509/verify.go
|
|
+++ b/src/crypto/x509/verify.go
|
|
@@ -845,6 +845,9 @@ func (c *Certificate) buildChains(cache map[*Certificate][][]*Certificate, curre
|
|
)
|
|
|
|
considerCandidate := func(certType int, candidate *Certificate) {
|
|
+ if candidate.PublicKey == nil {
|
|
+ return
|
|
+ }
|
|
for _, cert := range currentChain {
|
|
if cert.Equal(candidate) {
|
|
return
|
|
diff --git a/src/crypto/x509/verify_test.go b/src/crypto/x509/verify_test.go
|
|
index 76d1ab9a474..0606c0bbe01 100644
|
|
--- a/src/crypto/x509/verify_test.go
|
|
+++ b/src/crypto/x509/verify_test.go
|
|
@@ -1979,3 +1979,22 @@ func TestSystemRootsError(t *testing.T) {
|
|
t.Errorf("error was not SystemRootsError: %v", err)
|
|
}
|
|
}
|
|
+
|
|
+func TestVerifyNilPubKey(t *testing.T) {
|
|
+ c := &Certificate{
|
|
+ RawIssuer: []byte{1, 2, 3},
|
|
+ AuthorityKeyId: []byte{1, 2, 3},
|
|
+ }
|
|
+ opts := &VerifyOptions{}
|
|
+ opts.Roots = NewCertPool()
|
|
+ r := &Certificate{
|
|
+ RawSubject: []byte{1, 2, 3},
|
|
+ SubjectKeyId: []byte{1, 2, 3},
|
|
+ }
|
|
+ opts.Roots.AddCert(r)
|
|
+
|
|
+ _, err := c.buildChains(nil, []*Certificate{r}, nil, opts)
|
|
+ if _, ok := err.(UnknownAuthorityError); !ok {
|
|
+ t.Fatalf("buildChains returned unexpected error, got: %v, want %v", err, UnknownAuthorityError{})
|
|
+ }
|
|
+}
|
|
--
|
|
2.33.0
|
|
|