memory issues in libksba 1.3.4 and git

[Pascal Cuoq <cuoq () trust-in-soft com>]

Hello all,

this GitHub commit illustrates a memory issue present in in libksba 1.3.4 and in the current git tree from 
git://git.gnupg.org/libksba.git :

https://github.com/pascal-cuoq/libksba-fork/commit/709642767fbf7f2030d89bca4e4b192d612400ae

In summary:

Executing “tests/cert-basic long_time.crt” allocates a disproportionate 33MB of memory. In the current libksba git 
snapshot, this memory is initialized to zero, which takes a couple of milliseconds (probably mostly spent handling 
pagefaults), which is more than it should take to parse a certificate of a few hundred bytes on a modern computer. In 
version 1.3.4, the memory is left uninitialized, so no time is wasted. The commit that causes the memory to be 
initialized is https://github.com/pascal-cuoq/libksba-fork/commit/2a9fc5654df497b91ab9b64e946c1e19371888e5 and this 
commit was applied to prevent uninitialized memory from being incorporated into computations.

Executing “tests/cert-basic 90s.crt” allocates 60146387817 bytes (60GB). In the current libksba git snapshot, 
initializing this memory takes several seconds.

Executing “tests/cert-basic 0.0.0.0.0.crt” allocates 3MB of memory, which are either left uninitialized (1.3.4 version) 
or initialized to zero (git version). A large part of this memory is then converted to an “AuthorityKeyIdentifier”. In 
the git version, this produces a long sequence of 0.0.0.0... In version 1.3.4, since it's uninitialized memory that is 
used, the sequence may look different, and may contain secrets. “Secrets” here include cryptographic secrets that would 
unhygienically have been left in a freed memory block, but also addresses of variables, of library functions, etc. that 
might make another vulnerability exploitable.

These inputs have been set to Werner Koch, privately as per his request, on May 25, June 11 and July 11. I am 
publishing them now so that anyone who uses or might want to use libksba to parse messages (received 
pre-authentification by definition) can make an informed choice considering the risks of denial of service and 
information leak.


The inputs were found and kindly placed in the “hangs” result directory by afl-fuzz. The undefined behaviors caused by 
the inputs were investigated with tis-interpreter and a dependency analysis prototype developed by Raphaël Rieu-Helft. 
The results shown in https://github.com/pascal-cuoq/libksba-fork/blob/master/log were obtained by running ./autogen.sh, 
./configure and make to build an instrumented version of libksba on a 128GiB Linux workstation (Ubuntu 16.04).

Pascal