[PATCH] Fix CVE-2025-68972: Form feed detection in cleartext signatures

Hi Gnupg developers,

I'm submitting a fix for CVE-2025-68972, a signature verification bypass
in GnuPG 2.4.x documented at https://gpg.fail/formfeed.

*Summary*
The vulnerability allows an attacker to extend signed messages with
arbitrary data that still passes signature verification. This occurs
because commit 976e9d608 (Nov 2022) added form feed (\f) insertion for
truncated lines but did not add corresponding detection during signature
verification.

*Root Cause*
In g10/armor.c (line 784), truncated lines get a form feed character:
    afx->buffer[afx->buffer_len++] = this_truncated? '\f':'\n';

However, g10/plaintext.c's handle_plaintext() function does not check
for '\f' during hash calculation, allowing the exploit described at
https://gpg.fail/formfeed.

*The Fix*
The attached patch (CVE-2025-68972.patch) adds form feed detection in the
cleartext signature
hash calculation state machine. When '\f' is encountered, the function
logs an error and fails with GPG_ERR_BAD_SIGNATURE.


I'm happy to provide additional information, make adjustments to the
patch, or answer any questions.

Best regards,
Shani Yosef

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

diff --git a/g10/plaintext.c b/g10/plaintext.c
index 5c21dd7f6..d7f9df1f8 100644
--- a/g10/plaintext.c
+++ b/g10/plaintext.c
@@ -476,6 +476,13 @@ handle_plaintext (PKT_plaintext * pt, md_filter_context_t * mfx,
 		state = 1;
 	      else if (c == '\n')
 		state = 2;
+	      else if (c == '\f')
+		{
+		  /* Form feed indicates line truncation - this is a security issue */
+		  log_error ("cleartext signature contains truncated line (form feed detected)\n");
+		  err = gpg_error (GPG_ERR_BAD_SIGNATURE);
+		  goto leave;
+		}
 	      else
 		gcry_md_putc (mfx->md, c);
 	    }
@@ -486,6 +493,12 @@ handle_plaintext (PKT_plaintext * pt, md_filter_context_t * mfx,
 	      else
 		{
 		  gcry_md_putc (mfx->md, '\r');
+		  if (c == '\f')
+		    {
+		      log_error ("cleartext signature contains truncated line (form feed detected)\n");
+		      err = gpg_error (GPG_ERR_BAD_SIGNATURE);
+		      goto leave;
+		    }
 		  if (c == '\r')
 		    state = 1;
 		  else