From 0dcf83630b814278bc2dca9610926607df0d8c94 Mon Sep 17 00:00:00 2001 From: lizhipeng Date: Wed, 1 Oct 2025 23:10:53 +0800 Subject: [PATCH] Fix CVE-2025-9230 Signed-off-by: lizhipeng --- Backport-Fix-CVE-2025-9230.patch | 31 +++++++++++++++++++++++++++++++ openssl.spec | 6 +++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 Backport-Fix-CVE-2025-9230.patch diff --git a/Backport-Fix-CVE-2025-9230.patch b/Backport-Fix-CVE-2025-9230.patch new file mode 100644 index 0000000..500180b --- /dev/null +++ b/Backport-Fix-CVE-2025-9230.patch @@ -0,0 +1,31 @@ +From a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def Mon Sep 17 00:00:00 2001 +From: Viktor Dukhovni +Date: Thu, 11 Sep 2025 18:10:12 +0200 +Subject: [PATCH] kek_unwrap_key(): Fix incorrect check of unwrapped key size + +Fixes CVE-2025-9230 + +The check is off by 8 bytes so it is possible to overread by +up to 8 bytes and overwrite up to 4 bytes. + +Reviewed-by: Neil Horman +Reviewed-by: Matt Caswell +Reviewed-by: Tomas Mraz +(cherry picked from commit 9c462be2cea54ebfc62953224220b56f8ba22a0c) +--- + crypto/cms/cms_pwri.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/cms/cms_pwri.c b/crypto/cms/cms_pwri.c +index d5c3c8d399dfd..33a7ccaa76a3a 100644 +--- a/crypto/cms/cms_pwri.c ++++ b/crypto/cms/cms_pwri.c +@@ -229,7 +229,7 @@ static int kek_unwrap_key(unsigned char *out, size_t *outlen, + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } diff --git a/openssl.spec b/openssl.spec index 0846e89..8b09575 100755 --- a/openssl.spec +++ b/openssl.spec @@ -2,7 +2,7 @@ Name: openssl Epoch: 1 Version: 3.0.12 -Release: 17 +Release: 18 Summary: Cryptography and SSL/TLS Toolkit License: OpenSSL and SSLeay URL: https://www.openssl.org/ @@ -82,6 +82,7 @@ Patch67: 0001-add-support-for-sw_64-architecture.patch Patch9000: add-FIPS_mode_set-support.patch Patch9001: backport-CVE-2024-9143-Harden-BN_GF2m_poly2arr-against-misuse.patch Patch9002: Fix-build-error-for-ppc64le.patch +Patch9003: Backport-Fix-CVE-2025-9230.patch BuildRequires: gcc gcc-c++ perl make lksctp-tools-devel coreutils util-linux zlib-devel Requires: coreutils %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -282,6 +283,9 @@ make test || : %ldconfig_scriptlets libs %changelog +* Wed Oct 1 2025 lizhipeng - 1:3.0.12-18 +- fix CVE-2025-9230 + * Thu Apr 3 2025 swcompiler - 1:3.0.12-17 - add support for sw_64 architecture -- Gitee