Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 730752 (CVE-2020-36421, CVE-2020-36422, CVE-2020-36423) - <net-libs/mbedtls-{2.16.7,2.23.0}: Multiple vulnerabilities (CVE-2020-{36421,36422,36423})
Summary: <net-libs/mbedtls-{2.16.7,2.23.0}: Multiple vulnerabilities (CVE-2020-{36421,...
Status: IN_PROGRESS
Alias: CVE-2020-36421, CVE-2020-36422, CVE-2020-36423
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [glsa cve]
Keywords: PullRequest
Depends on:
Blocks: CVE-2020-16150, CVE-2020-36424, CVE-2020-36425, CVE-2020-36426
  Show dependency tree
 
Reported: 2020-07-04 18:49 UTC by Sam James
Modified: 2021-07-19 15:27 UTC (History)
2 users (show)

See Also:
Package list:
net-libs/mbedtls-2.16.7-r1 amd64 arm64 ppc64 x86 net-libs/mbedtls-2.23.0-r1 amd64 arm64 ppc64 x86
Runtime testing required: ---
nattka: sanity-check-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester gentoo-dev Security 2020-07-04 18:49:20 UTC
Release notes:
* 2.16.7: https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.16.7
* 2.23.0: https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.23.0

"Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute of Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul Strackx (Fortanix) in 3394.

    Fix side channel in mbedtls_ecp_check_pub_priv() and mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private key that didn't include the uncompressed public key), as well as mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL f_rng argument. An attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave) could fully recover the ECC private key. Found and reported by Alejandro Cabrera Aldaya and Billy Brumley.

    Fix issue in Lucky 13 counter-measure that could make it ineffective when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT macros). This would cause the original Lucky 13 attack to be possible in those configurations, allowing an active network attacker to recover plaintext after repeated timing measurements under some conditions. Reported and fix suggested by Luc Perneel in 3246."

See https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07 for details on the first vulnerability.
Comment 1 Sam James archtester gentoo-dev Security 2020-07-04 18:50:24 UTC
Let us know when ready to stable, thanks!
Comment 2 Anthony Basile gentoo-dev 2020-07-05 15:11:16 UTC
(In reply to Sam James (sec padawan) from comment #1)
> Let us know when ready to stable, thanks!

They should be ready.

KEYWORDS="amd64 arm arm64 ppc ppc64 x86"
Comment 3 Sam James archtester gentoo-dev Security 2020-07-05 16:36:02 UTC
(In reply to Anthony Basile from comment #2)
> (In reply to Sam James (sec padawan) from comment #1)
> > Let us know when ready to stable, thanks!
> 
> They should be ready.
> 
> KEYWORDS="amd64 arm arm64 ppc ppc64 x86"

Thanks!
Comment 4 Sergei Trofimovich gentoo-dev 2020-07-08 07:50:01 UTC
ppc stable
Comment 5 Agostino Sarubbo gentoo-dev 2020-07-09 08:04:38 UTC
arm stable
Comment 6 Sam James archtester gentoo-dev Security 2020-07-17 00:05:43 UTC
amd64, ppc64, x86: ping
Comment 7 Sam James archtester gentoo-dev Security 2020-07-17 01:21:44 UTC
arm64 stable
Comment 8 Sam James archtester gentoo-dev Security 2020-07-17 01:39:01 UTC
ppc64 stable
Comment 9 Sam James archtester gentoo-dev Security 2020-07-17 23:30:21 UTC
x86 stable
Comment 10 Sam James archtester gentoo-dev Security 2020-07-17 23:30:44 UTC
amd64 stable

----
Please cleanup.
Comment 11 Sam James archtester gentoo-dev Security 2020-07-26 15:58:12 UTC
GLSA vote: yes
Comment 12 John Helmert III gentoo-dev Security 2020-09-21 03:28:21 UTC
Ping
Comment 13 Larry the Git Cow gentoo-dev 2020-10-04 14:01:19 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2eec5b536cc676a688ff316087a71c31d4ffe303

commit 2eec5b536cc676a688ff316087a71c31d4ffe303
Author:     John Helmert III <jchelmert3@posteo.net>
AuthorDate: 2020-10-04 02:12:25 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2020-10-04 14:00:01 +0000

    net-libs/mbedtls: security cleanup
    
    Bug: https://bugs.gentoo.org/730752
    Package-Manager: Portage-3.0.8, Repoman-3.0.1
    Signed-off-by: John Helmert III <jchelmert3@posteo.net>
    Closes: https://github.com/gentoo/gentoo/pull/17764
    Signed-off-by: Sam James <sam@gentoo.org>

 net-libs/mbedtls/Manifest                 |  2 -
 net-libs/mbedtls/mbedtls-2.16.6.ebuild    | 94 -------------------------------
 net-libs/mbedtls/mbedtls-2.22.0-r1.ebuild | 94 -------------------------------
 3 files changed, 190 deletions(-)
Comment 14 NATTkA bot gentoo-dev 2020-10-31 12:08:56 UTC Comment hidden (obsolete)
Comment 15 NATTkA bot gentoo-dev 2021-04-01 20:12:44 UTC
Unable to check for sanity:

> no match for package: net-libs/mbedtls-2.16.7-r1
Comment 16 John Helmert III gentoo-dev Security 2021-07-18 18:48:58 UTC
CVEs requested for these.
Comment 17 John Helmert III gentoo-dev Security 2021-07-19 15:27:34 UTC
(In reply to Sam James from comment #0)
> Release notes:
> * 2.16.7: https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.16.7
> * 2.23.0: https://github.com/ARMmbed/mbedtls/releases/tag/mbedtls-2.23.0
> 
> "Fix a side channel vulnerability in modular exponentiation that could
> reveal an RSA private key used in a secure enclave. Noticed by Sangho Lee,
> Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute of
> Technology); and Marcus Peinado (Microsoft Research). Reported by Raoul
> Strackx (Fortanix) in 3394.

CVE-2020-37421

>     Fix side channel in mbedtls_ecp_check_pub_priv() and
> mbedtls_pk_parse_key() / mbedtls_pk_parse_keyfile() (when loading a private
> key that didn't include the uncompressed public key), as well as
> mbedtls_ecp_mul() / mbedtls_ecp_mul_restartable() when called with a NULL
> f_rng argument. An attacker with access to precise enough timing and memory
> access information (typically an untrusted operating system attacking a
> secure enclave) could fully recover the ECC private key. Found and reported
> by Alejandro Cabrera Aldaya and Billy Brumley.

CVE-2020-36422

>     Fix issue in Lucky 13 counter-measure that could make it ineffective
> when hardware accelerators were used (using one of the MBEDTLS_SHAxxx_ALT
> macros). This would cause the original Lucky 13 attack to be possible in
> those configurations, allowing an active network attacker to recover
> plaintext after repeated timing measurements under some conditions. Reported
> and fix suggested by Luc Perneel in 3246."

CVE-2020-36423

> See
> https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-
> advisory-2020-07 for details on the first vulnerability.