GnuTLS | Heap Use-After-Free in `gnutls_pkcs7_get_signature_info()` Error Cleanup (#1896)
Read-only notification of GnuTLS library development activities <[email protected]> Thu, 04 Jun 2026 18:28:14 +0000
| Newsgroups | gmane.comp.encryption.gpg.gnutls.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============2564725807166509077==
Content-Type: multipart/alternative;
boundary="--==_mimepart_6a21c3bee36d_37a8ba10283665";
charset=UTF-8
Content-Transfer-Encoding: 7bit
----==_mimepart_6a21c3bee36d_37a8ba10283665
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Issue created by =E9=BD=90=E6=9F=AF=E5=AE=87 (Qi Kery): https://gitlab.co=
m/gnutls/gnutls/-/work_items/1896
This report was generated with AI assistance and manually verified.
## Description of problem:
`gnutls_pkcs7_get_signature_info()` can use a freed PKCS#7 attribute list=
during error cleanup.
While copying signed attributes, `gnutls_pkcs7_get_signature_info()` call=
s:
```c
ret =3D gnutls_pkcs7_add_attr(&info->signed_attrs, oid, &tmp, 0);
```
If `gnutls_pkcs7_add_attr()` fails after `*list` already contains entries=
, its failure path calls `gnutls_pkcs7_attrs_deinit(*list)` but does not =
set `*list` to `NULL`. Control then returns to `gnutls_pkcs7_get_signatur=
e_info()`, which reaches its `fail:` label and calls `gnutls_pkcs7_signat=
ure_info_deinit(info)`. That cleanup path traverses `info->signed_attrs`,=
which still points to freed memory.
Affected code:
```text
lib/x509/pkcs7.c:702 gnutls_pkcs7_add_attr(&info->signed_attrs, ...)
lib/x509/pkcs7.c:751 gnutls_pkcs7_signature_info_deinit(info)
lib/x509/pkcs7-attrs.c:86 gnutls_pkcs7_attrs_deinit(*list)
```
## Version of gnutls used:
```text
Upstream origin/master
Commit: 0b9fcb47c734191695b7b7812a0ba30a5c712b9f
Commit date: 2026-06-02 10:05:44 +0900
Configure summary version: 3.8.13 shared 72:0:42
```
## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)
```text
Upstream source build, not a distribution package.
Built locally on Ubuntu with glibc 2.39.
```
## How reproducible:
```text
Always reproducible with the attached/local harness and FAIL_AFTER=3D9.
The same harness exits successfully when FAIL_AFTER is not set.
```
Steps to Reproduce:
* Build GnuTLS from the commit above with hardening and sanitizers:
```text
CPPFLAGS=3D-D_FORTIFY_SOURCE=3D3
CFLAGS=3D-O2 -g -fno-omit-frame-pointer -fsanitize=3Daddress,undefined -f=
stack-protector-strong -fPIE
LDFLAGS=3D-fsanitize=3Daddress,undefined -Wl,-z,relro -Wl,-z,now -pie
```
The verified library was:
```text
<build-dir>/lib/.libs/libgnutls.so.30.42.0
SHA-256: 224c60682088ac07680c1eba04acd159b51bd8995bedcbc1fc288fe248a1058b=
```
* Compile the reproducer:
Reproducer source: [pkcs7_siginfo_fail_harness.c](https://github.com/Bin-=
infinite/vuln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/g=
nutls/latest/%63%61%73%65%2D002/pocs/pkcs7_siginfo_fail_harness.c)
This harness builds a valid PKCS#7 object with signed attributes using Gn=
uTLS APIs, imports it, and installs allocator wrappers only for the targe=
t call.
* Run the reproducer:
```bash
ASAN_OPTIONS=3D'abort_on_error=3D1:symbolize=3D1:detect_leaks=3D0:allocat=
or_may_return_null=3D1' \
UBSAN_OPTIONS=3D'halt_on_error=3D0:print_stacktrace=3D1' \
LSAN_OPTIONS=3D'detect_leaks=3D0' \
FAIL_AFTER=3D9 \
./pkcs7_siginfo_fail_harness
```
## Actual results:
ASan reports a heap-use-after-free:
```text
ERROR: AddressSanitizer: heap-use-after-free
READ of size 8
#0 gnutls_pkcs7_attrs_deinit lib/x509/pkcs7-attrs.c:152
#1 gnutls_pkcs7_signature_info_deinit lib/x509/pkcs7.c:483
#2 gnutls_pkcs7_get_signature_info lib/x509/pkcs7.c:751
freed by thread T0 here:
#1 gnutls_pkcs7_attrs_deinit lib/x509/pkcs7-attrs.c:156
#2 gnutls_pkcs7_add_attr lib/x509/pkcs7-attrs.c:86
#3 gnutls_pkcs7_get_signature_info lib/x509/pkcs7.c:702
previously allocated by thread T0 here:
#1 gnutls_pkcs7_add_attr lib/x509/pkcs7-attrs.c:59
#2 gnutls_pkcs7_get_signature_info lib/x509/pkcs7.c:702
```
Full log: [fail_after_9_run1.stderr.txt](https://github.com/Bin-infinite/=
vuln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/lat=
est/%63%61%73%65%2D002/runs/fail_after_9_run1.stderr.txt)
## Expected results:
`gnutls_pkcs7_get_signature_info()` should return a negative error code w=
ithout using a freed attribute list. The ownership contract should be mad=
e consistent. For example, `gnutls_pkcs7_add_attr()` could set `*list =3D=
NULL` after freeing the existing list, or avoid destructively freeing th=
e caller's existing list on failure.
-- =
Reply to this email directly or view it on GitLab: https://gitlab.com/gnu=
tls/gnutls/-/work_items/1896
You're receiving this email because of your account on gitlab.com. Unsubs=
cribe from this thread: https://gitlab.com/-/sent_notifications/5-4v51n0f=
hb6dh4c278kxr883vj-a84t7/unsubscribe | Manage all notifications: https://=
gitlab.com/-/profile/notifications | Help: https://gitlab.com/help
----==_mimepart_6a21c3bee36d_37a8ba10283665
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www=
.w3.org/TR/REC-html40/loose.dtd">
<html lang=3D"en" style=3D'--code-editor-font: var(--default-mono-font, "=
GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, =
Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospac=
e;'>
<head>
<meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Type">=
<title>
GitLab
</title>
<style data-premailer=3D"ignore" type=3D"text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Ro=
boto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Colo=
r Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size=
: inherit;
}
</style>
</head>
<body style=3D'font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.0=
1) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"=
Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif=
,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji=
";'>
<div class=3D"content">
<p class=3D"details" style=3D"font-style: italic; color: #626168;">
Issue created by <a href=3D"https://gitlab.com/Keryer">=E9=BD=90=E6=9F=AF=
=E5=AE=87 (Qi Kery)</a>: <a href=3D"https://gitlab.com/gnutls/gnutls/-/wo=
rk_items/1896">#1896</a>
</p>
<div class=3D"md" style=3D"position: relative; z-index: 1; color: #3a383f=
; word-wrap: break-word;">
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">This report was generated with AI assistance and manually verifi=
ed.</p>
<h2 id=3D"user-content-description-of-problem" dir=3D"auto" style=3D"marg=
in-top: 20px; margin-bottom: 10px;" align=3D"initial">Description of prob=
lem:<a href=3D"#description-of-problem" aria-label=3D"Link to heading 'De=
scription of problem:'" data-heading-content=3D"Description of problem:" =
class=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial"><code style=3D'font-size: 90%; color: #18171d; word-wrap: break-=
word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; =
font-weight: inherit; overflow-wrap: break-word; white-space: break-space=
s; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mo=
no", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale=
mono", "lucida console", monospace; font-variant-ligatures: none; word-b=
reak: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs7_get_signature_in=
fo()</code> can use a freed PKCS#7 attribute list during error cleanup.</=
p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">While copying signed attributes, <code style=3D'font-size: 90%; =
color: #18171d; word-wrap: break-word; background-color: #ececef; border-=
radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: bre=
ak-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrain=
s Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubu=
ntu Mono", "Courier New", "andale mono", "lucida console", monospace; fon=
t-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25re=
m;'>gnutls_pkcs7_get_signature_info()</code> calls:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"c" class=3D"code highlight js-syntax-highligh=
t language-c" v-pre=3D"true" style=3D'display: block; font-size: 14px; co=
lor: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem=
; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menl=
o", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Co=
urier New", "andale mono", "lucida console", monospace; font-variant-liga=
tures: none; word-break: break-all; word-wrap: break-word; background-col=
or: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde=
;'><code style=3D'font-size: inherit; color: inherit; word-wrap: normal; =
word-break: keep-all; background-color: inherit; border-radius: .25rem; w=
hite-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains =
Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubunt=
u Mono", "Courier New", "andale mono", "lucida console", monospace; font-=
variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id=
=3D"LC1" class=3D"line" lang=3D"c" style=3D"margin-top: 0px;"><span class=
=3D"n" style=3D"margin-top: 0px;">ret</span> <span class=3D"o">=3D</span>=
<span class=3D"n">gnutls_pkcs7_add_attr</span><span class=3D"p">(</span>=
<span class=3D"o">&</span><span class=3D"n">info</span><span class=3D=
"o">-></span><span class=3D"n">signed_attrs</span><span class=3D"p">,<=
/span> <span class=3D"n">oid</span><span class=3D"p">,</span> <span class=
=3D"o">&</span><span class=3D"n">tmp</span><span class=3D"p">,</span>=
<span class=3D"mi">0</span><span class=3D"p">);</span></span></code></pr=
e>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">If <code style=3D'font-size: 90%; color: #18171d; word-wrap: bre=
ak-word; background-color: #ececef; border-radius: .25rem; margin-top: 0p=
x; font-weight: inherit; overflow-wrap: break-word; white-space: break-sp=
aces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans=
Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "and=
ale mono", "lucida console", monospace; font-variant-ligatures: none; wor=
d-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs7_add_attr()</c=
ode> fails after <code style=3D'font-size: 90%; color: #18171d; word-wrap=
: break-word; background-color: #ececef; border-radius: .25rem; font-weig=
ht: inherit; overflow-wrap: break-word; white-space: break-spaces; font-f=
amily: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Lib=
eration Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "=
lucida console", monospace; font-variant-ligatures: none; word-break: kee=
p-all; padding: 0.125rem 0.25rem;'>*list</code> already contains entries,=
its failure path calls <code style=3D'font-size: 90%; color: #18171d; wo=
rd-wrap: break-word; background-color: #ececef; border-radius: .25rem; fo=
nt-weight: inherit; overflow-wrap: break-word; white-space: break-spaces;=
font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono=
", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale m=
ono", "lucida console", monospace; font-variant-ligatures: none; word-bre=
ak: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs7_attrs_deinit(*list=
)</code> but does not set <code style=3D'font-size: 90%; color: #18171d; =
word-wrap: break-word; background-color: #ececef; border-radius: .25rem; =
font-weight: inherit; overflow-wrap: break-word; white-space: break-space=
s; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mo=
no", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale=
mono", "lucida console", monospace; font-variant-ligatures: none; word-b=
reak: keep-all; padding: 0.125rem 0.25rem;'>*list</code> to <code style=3D=
'font-size: 90%; color: #18171d; word-wrap: break-word; background-color:=
#ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: bre=
ak-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrain=
s Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubu=
ntu Mono", "Courier New", "andale mono", "lucida console", monospace; fon=
t-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25re=
m;'>NULL</code>. Control then returns to <code style=3D'font-size: 90%; c=
olor: #18171d; word-wrap: break-word; background-color: #ececef; border-r=
adius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-spa=
ce: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", =
"DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courie=
r New", "andale mono", "lucida console", monospace; font-variant-ligature=
s: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs7_g=
et_signature_info()</code>, which reaches its <code style=3D'font-size: 9=
0%; color: #18171d; word-wrap: break-word; background-color: #ececef; bor=
der-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; whit=
e-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Men=
lo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "C=
ourier New", "andale mono", "lucida console", monospace; font-variant-lig=
atures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>fail:</co=
de> label and calls <code style=3D'font-size: 90%; color: #18171d; word-w=
rap: break-word; background-color: #ececef; border-radius: .25rem; font-w=
eight: inherit; overflow-wrap: break-word; white-space: break-spaces; fon=
t-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "=
Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono"=
, "lucida console", monospace; font-variant-ligatures: none; word-break: =
keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs7_signature_info_deinit(=
info)</code>. That cleanup path traverses <code style=3D'font-size: 90%; =
color: #18171d; word-wrap: break-word; background-color: #ececef; border-=
radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-sp=
ace: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo",=
"DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Couri=
er New", "andale mono", "lucida console", monospace; font-variant-ligatur=
es: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>info->sign=
ed_attrs</code>, which still points to freed memory.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Affected code:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">lib/x509/pkcs7.c:702 gnutls_pkcs7_add_attr(&info->signed=
_attrs, ...)</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">lib/x509/pkcs7.c:751 =
gnutls_pkcs7_signature_info_deinit(info)</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">lib/x509/pkcs7-attrs.c=
:86 gnutls_pkcs7_attrs_deinit(*list)</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-version-of-gnutls-used" dir=3D"auto" style=3D"marg=
in-top: 20px; margin-bottom: 10px;" align=3D"initial">Version of gnutls u=
sed:<a href=3D"#version-of-gnutls-used" aria-label=3D"Link to heading 'Ve=
rsion of gnutls used:'" data-heading-content=3D"Version of gnutls used:" =
class=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Upstream origin/master</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">Commit: 0b9fcb47c73419=
1695b7b7812a0ba30a5c712b9f</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">Commit date: 2026-06-0=
2 10:05:44 +0900</span>
<span id=3D"LC4" class=3D"line" lang=3D"plaintext">Configure summary vers=
ion: 3.8.13 shared 72:0:42</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" dir=3D=
"auto" style=3D"margin-top: 20px; margin-bottom: 10px;" align=3D"initial"=
>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)<a href=3D"#distributo=
r-of-gnutls-eg-ubuntu-fedora-rhel" aria-label=3D"Link to heading 'Distrib=
utor of gnutls (e.g., Ubuntu, Fedora, RHEL)'" data-heading-content=3D"Dis=
tributor of gnutls (e.g., Ubuntu, Fedora, RHEL)" class=3D"anchor" style=3D=
"margin-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Upstream source build, not a distribution package.</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">Built locally on Ubunt=
u with glibc 2.39.</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-how-reproducible" dir=3D"auto" style=3D"margin-top=
: 20px; margin-bottom: 10px;" align=3D"initial">How reproducible:<a href=3D=
"#how-reproducible" aria-label=3D"Link to heading 'How reproducible:'" da=
ta-heading-content=3D"How reproducible:" class=3D"anchor" style=3D"margin=
-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Always reproducible with the attached/local harness and FAIL_AFTE=
R=3D9.</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">The same harness exits=
successfully when FAIL_AFTER is not set.</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Steps to Reproduce:</p>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Build GnuTLS from the commit above with hardening and san=
itizers:</li>
</ul>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">CPPFLAGS=3D-D_FORTIFY_SOURCE=3D3</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">CFLAGS=3D-O2 -g -fno-o=
mit-frame-pointer -fsanitize=3Daddress,undefined -fstack-protector-strong=
-fPIE</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">LDFLAGS=3D-fsanitize=3D=
address,undefined -Wl,-z,relro -Wl,-z,now -pie</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The verified library was:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;"><build-dir>/lib/.libs/libgnutls.so.30.42.0</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">SHA-256: 224c60682088a=
c07680c1eba04acd159b51bd8995bedcbc1fc288fe248a1058b</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Compile the reproducer:</li>
</ul>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Reproducer source: <a href=3D"https://github.com/Bin-infinite/vu=
ln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/lates=
t/%63%61%73%65%2D002/pocs/pkcs7_siginfo_fail_harness.c" rel=3D"nofollow n=
oreferrer noopener" target=3D"_blank" style=3D"margin-top: 0px;">pkcs7_si=
ginfo_fail_harness.c</a></p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">This harness builds a valid PKCS#7 object with signed attributes=
using GnuTLS APIs, imports it, and installs allocator wrappers only for =
the target call.</p>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Run the reproducer:</li>
</ul>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"bash" class=3D"code highlight js-syntax-highl=
ight language-shell" v-pre=3D"true" style=3D'display: block; font-size: 1=
4px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius:=
.25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono"=
, "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mon=
o", "Courier New", "andale mono", "lucida console", monospace; font-varia=
nt-ligatures: none; word-break: break-all; word-wrap: break-word; backgro=
und-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid =
#dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wrap: n=
ormal; word-break: keep-all; background-color: inherit; border-radius: .2=
5rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "Jet=
Brains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas",=
"Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace=
; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><=
span id=3D"LC1" class=3D"line" lang=3D"shell" style=3D"margin-top: 0px;">=
<span class=3D"nv" style=3D"margin-top: 0px;">ASAN_OPTIONS</span><span cl=
ass=3D"o">=3D</span><span class=3D"s1">'abort_on_error=3D1:symbolize=3D1:=
detect_leaks=3D0:allocator_may_return_null=3D1'</span> <span class=3D"se"=
>\</span></span>
<span id=3D"LC2" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">UBSAN_OPTIONS</span><span class=3D"o">=3D</span><span =
class=3D"s1">'halt_on_error=3D0:print_stacktrace=3D1'</span> <span class=3D=
"se">\</span></span>
<span id=3D"LC3" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">LSAN_OPTIONS</span><span class=3D"o">=3D</span><span c=
lass=3D"s1">'detect_leaks=3D0'</span> <span class=3D"se">\</span></span>
<span id=3D"LC4" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">FAIL_AFTER</span><span class=3D"o">=3D</span>9 <span c=
lass=3D"se">\</span></span>
<span id=3D"LC5" class=3D"line" lang=3D"shell">./pkcs7_siginfo_fail_harne=
ss</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-actual-results" dir=3D"auto" style=3D"margin-top: =
20px; margin-bottom: 10px;" align=3D"initial">Actual results:<a href=3D"#=
actual-results" aria-label=3D"Link to heading 'Actual results:'" data-hea=
ding-content=3D"Actual results:" class=3D"anchor" style=3D"margin-top: 0p=
x;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">ASan reports a heap-use-after-free:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">ERROR: AddressSanitizer: heap-use-after-free</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">READ of size 8</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">#0 gnutls_pkcs7_attrs_=
deinit lib/x509/pkcs7-attrs.c:152</span>
<span id=3D"LC4" class=3D"line" lang=3D"plaintext">#1 gnutls_pkcs7_signat=
ure_info_deinit lib/x509/pkcs7.c:483</span>
<span id=3D"LC5" class=3D"line" lang=3D"plaintext">#2 gnutls_pkcs7_get_si=
gnature_info lib/x509/pkcs7.c:751</span>
<span id=3D"LC6" class=3D"line" lang=3D"plaintext"></span>
<span id=3D"LC7" class=3D"line" lang=3D"plaintext">freed by thread T0 her=
e:</span>
<span id=3D"LC8" class=3D"line" lang=3D"plaintext">#1 gnutls_pkcs7_attrs_=
deinit lib/x509/pkcs7-attrs.c:156</span>
<span id=3D"LC9" class=3D"line" lang=3D"plaintext">#2 gnutls_pkcs7_add_at=
tr lib/x509/pkcs7-attrs.c:86</span>
<span id=3D"LC10" class=3D"line" lang=3D"plaintext">#3 gnutls_pkcs7_get_s=
ignature_info lib/x509/pkcs7.c:702</span>
<span id=3D"LC11" class=3D"line" lang=3D"plaintext"></span>
<span id=3D"LC12" class=3D"line" lang=3D"plaintext">previously allocated =
by thread T0 here:</span>
<span id=3D"LC13" class=3D"line" lang=3D"plaintext">#1 gnutls_pkcs7_add_a=
ttr lib/x509/pkcs7-attrs.c:59</span>
<span id=3D"LC14" class=3D"line" lang=3D"plaintext">#2 gnutls_pkcs7_get_s=
ignature_info lib/x509/pkcs7.c:702</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Full log: <a href=3D"https://github.com/Bin-infinite/vuln-valida=
tions/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/latest/%63%61%=
73%65%2D002/runs/fail_after_9_run1.stderr.txt" rel=3D"nofollow noreferrer=
noopener" target=3D"_blank" style=3D"margin-top: 0px;">fail_after_9_run1=
.stderr.txt</a></p>
<h2 id=3D"user-content-expected-results" dir=3D"auto" style=3D"margin-top=
: 20px; margin-bottom: 10px;" align=3D"initial">Expected results:<a href=3D=
"#expected-results" aria-label=3D"Link to heading 'Expected results:'" da=
ta-heading-content=3D"Expected results:" class=3D"anchor" style=3D"margin=
-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px;" align=3D"initial">=
<code style=3D'font-size: 90%; color: #18171d; word-wrap: break-word; bac=
kground-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weig=
ht: inherit; overflow-wrap: break-word; white-space: break-spaces; font-f=
amily: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Lib=
eration Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "=
lucida console", monospace; font-variant-ligatures: none; word-break: kee=
p-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs7_get_signature_info()</cod=
e> should return a negative error code without using a freed attribute li=
st. The ownership contract should be made consistent. For example, <code =
style=3D'font-size: 90%; color: #18171d; word-wrap: break-word; backgroun=
d-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-w=
rap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "=
JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consola=
s", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monosp=
ace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125re=
m 0.25rem;'>gnutls_pkcs7_add_attr()</code> could set <code style=3D'font-=
size: 90%; color: #18171d; word-wrap: break-word; background-color: #ecec=
ef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-wor=
d; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono=
", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mo=
no", "Courier New", "andale mono", "lucida console", monospace; font-vari=
ant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>*l=
ist =3D NULL</code> after freeing the existing list, or avoid destructive=
ly freeing the caller's existing list on failure.</p>
</div>
</div>
<div class=3D"footer" style=3D"margin-top: 10px;">
<p style=3D"font-size: small; color: #626168;">
=E2=80=94
<br>
Reply to this email directly or <a href=3D"https://gitlab.com/gnutls/gnut=
ls/-/work_items/1896">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target=3D"_blan=
k" rel=3D"noopener noreferrer" href=3D"https://gitlab.com">gitlab.com</a>=
. <a href=3D"https://gitlab.com/-/sent_notifications/5-4v51n0fhb6dh4c278k=
xr883vj-a84t7/unsubscribe" target=3D"_blank" rel=3D"noopener noreferrer">=
Unsubscribe</a> from this thread =C2=B7 <a href=3D"https://gitlab.com/-/p=
rofile/notifications" target=3D"_blank" rel=3D"noopener noreferrer" class=
=3D"mng-notif-link">Manage all notifications</a> =C2=B7 <a href=3D"https:=
//gitlab.com/help" target=3D"_blank" rel=3D"noopener noreferrer" class=3D=
"help-link">Help</a>
<span style=3D"color: transparent; font-size: 0; display: none; overflow:=
hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/work_it=
ems/1896 at 1780597694
</span>
<script type=3D"application/ld+json">{"@context":"http://schema.org","@ty=
pe":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item"=
,"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1896"}}</script>
</p>
</div>
</body>
</html>
----==_mimepart_6a21c3bee36d_37a8ba10283665--
--===============2564725807166509077==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Gnutls-devel mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-devel
--===============2564725807166509077==--