Project

General

Profile

Actions
Copy link

Bug #4233

closed
PA PA

ssl : Integer underflow in ssl parsing SSLV3_HANDSHAKE_PROTOCOL

Bug #4233: ssl : Integer underflow in ssl parsing SSLV3_HANDSHAKE_PROTOCOL

Added by Philippe Antoine over 5 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
7.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28399

First we being parsing SSLV3_HANDSHAKE_PROTOCOL
We set message_start, bytes_processed and message_length in SSLv3ParseHandshakeProtocol

Then, we break out of this SSLV3_HANDSHAKE_PROTOCOL parsing because the other side of the connexion set SSL_AL_FLAG_CHANGE_CIPHER_SPEC
This leads to increasing bytes_processed at the end of SSLv3Decode

Then, we do not break anymore out of this SSLV3_HANDSHAKE_PROTOCOL parsing because the other side set SSL_AL_FLAG_STATE_CLIENT_HELLO
And bytes_processed is now over message_start + message_length

Related issues 3 (0 open — 3 closed)

Has duplicate Suricata - Bug #4524: AssertionError in SSLv3ParseHandshakeType RejectedActions
Copied to Suricata - Bug #4297: ssl : Integer underflow in ssl parsing SSLV3_HANDSHAKE_PROTOCOLClosedJeff LucovskyActions
Copied to Suricata - Bug #4298: ssl : Integer underflow in ssl parsing SSLV3_HANDSHAKE_PROTOCOLClosedVictor JulienActions

PA Updated by Philippe Antoine about 5 years ago Actions
Copy link
 #1

  • Status changed from New to In Review

Gitlab MR

JL Updated by Jeff Lucovsky about 5 years ago Actions
Copy link
 #2

  • Label deleted (Needs backport to 4.1)

JL Updated by Jeff Lucovsky about 5 years ago Actions
Copy link
 #3

  • Copied to Bug #4297: ssl : Integer underflow in ssl parsing SSLV3_HANDSHAKE_PROTOCOL added

JL Updated by Jeff Lucovsky about 5 years ago Actions
Copy link
 #4

  • Copied to Bug #4298: ssl : Integer underflow in ssl parsing SSLV3_HANDSHAKE_PROTOCOL added

VJ Updated by Victor Julien about 5 years ago Actions
Copy link
 #5

  • Target version changed from 6.0.2 to 7.0.0-beta1

PA Updated by Philippe Antoine about 5 years ago Actions
Copy link
 #6

Victor Julien wrote in #note-5:

https://github.com/OISF/suricata/commit/00d7c9034be7470177c01e8805831c258b016d0e

This commit seems for another issue...

PA Updated by Philippe Antoine almost 5 years ago Actions
Copy link
 #8

  • Has duplicate Bug #4524: AssertionError in SSLv3ParseHandshakeType added

VJ Updated by Victor Julien over 4 years ago Actions
Copy link
 #9

  • Private changed from Yes to No
Actions
Copy link

Also available in: PDF Atom