oss-sec mailing list archives
Re: Denial of service in GnuPG
From: Demi Marie Obenour <demi () invisiblethingslab com>
Date: Mon, 4 Jul 2022 16:17:17 -0400
It has come to my attention that my original post caused at least two mail clients to hang. Sorry about that; I did not expect any mail client to eagerly parse the attachments. This version wraps the attachments in a password-protected zip file (password: MitB7vqh). It also includes some additional information. GnuPG is vulnerable to a denial of service attack when processing crafted detached signatures and/or certificates. By concatenating the same signature to itself a very large number of times, and then wrapping them in a compressed packet, I am able to cause GnuPG to take over a minute to process an input that is less than 5KB armored. I have attached two files: - A patch (based on one submitted upstream) that fixes the bug for keys, detached signatures, and cleartext signatures. It does not fix the bug for other types of OpenPGP data, as I am not sure if the obvious fix (only allowing a single literal data packet in a compressed packet) would render data already in the wild inaccessible. The only difference between this patch and the one sent upstream already is that this one prevents attacks involving cleartext signatures. - An encrypted zip file (see above for password) that contains a proof of concept exploit. Both the public key and the detached signature (of an empty file) are included. -- Sincerely, Demi Marie Obenour (she/her/hers) Invisible Things Lab
Attachment:
v3-0001-Disallow-compressed-signatures-and-certificates.patch
Description:
Attachment:
gnupg-dos.zip
Description:
Attachment:
signature.asc
Description:
Current thread:
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG, (continued)
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG Demi Marie Obenour (Jul 06)
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG Alexander Burke (Jul 06)
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG Solar Designer (Jul 06)
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG Demi Marie Obenour (Jul 06)
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG Solar Designer (Jul 06)
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG Grant Taylor (Jul 06)
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG Demi Marie Obenour (Jul 06)
- Re: Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG Florian Weimer (Jul 06)