Security Advisory 2021-02-02-2 - wolfSSL heap buffer overflow in RsaPad_PSS (CVE-2020-36177)
ynezz at true.cz
Wed Feb 3 09:34:03 EST 2021
RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds
write for certain relationships between key size and digest size. The issue is
marked as critical with CVSS score of 9.8 (10 is most severe).
wolfSSL library is provided as `libwolfssl24` package in OpenWrt and shipped
by default in snapshots since August 27th 2020. It's NOT shipped by default
in latest stable OpenWrt release 19.07.
It's still work in progress, there is not that much information about it
available yet, but according to the very high CVSS score of 9.8 (10 is most
severe) it's likely, that this issue has RCE potential.
You can check for updates on dedicated wiki page and forum topic if
You need to update the affected `libwolfssl24` package you're using with the
opkg update; opkg upgrade libwolfssl24
Then verify, that you're running fixed version.
opkg list-installed libwolfssl24
The above command should output following:
libwolfssl24 - 4.6.0-stable-1 - for stable OpenWrt 19.07 release
libwolfssl24 - 4.6.0-stable-1 - for master/snapshot
The fix is contained in the following and later versions:
* OpenWrt master: 2021-01-01 reboot-15389-gba40da9045f7
* OpenWrt 19.07: 2021-02-02 v19.07.6-11-g2044c01de8f2
To our knowledge, OpenWrt snapshot images are affected. OpenWrt stable release
versions 19.07.0 to 19.07.6 are not affected, because vulnerable `libwolfssl24`
package is not shipped by default in the official firmware images. Older
versions of OpenWrt (e.g. OpenWrt 18.06, OpenWrt 15.05 and LEDE 17.01) are end
of life and not supported any more.
This issue seems to be found by libFuzzer's address sanitizer in OSS-Fuzz project
and fixed by Sean Parkinson from wolfSSL team.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the openwrt-devel