GnuTLS | Null Pointer Dereference in x86 HMAC Fast Backend via `gnutls_hmac_fast()` (#1898)
Read-only notification of GnuTLS library development activities <[email protected]> Thu, 04 Jun 2026 18:30:36 +0000
| Newsgroups | gmane.comp.encryption.gpg.gnutls.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============0425901405998885604==
Content-Type: multipart/alternative;
boundary="--==_mimepart_6a21c44c22bde_3719445c3098ef";
charset=UTF-8
Content-Transfer-Encoding: 7bit
----==_mimepart_6a21c44c22bde_3719445c3098ef
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: 7bit
Issue created by Kery: https://gitlab.com/gnutls/gnutls/-/work_items/1898
This report was generated with AI assistance and manually verified.
## Description of problem:
The exported API `gnutls_hmac_fast()` can dispatch to the x86 SSSE3 HMAC backend with `key == NULL` and `keylen > 0`. The internal backend `wrap_x86_hmac_fast()` forwards the unchecked key pointer to `ctx.setkey()`, causing a NULL pointer read.
The harness calls the exported `gnutls_hmac_fast()` API. It does not directly call the internal static function.
Affected code:
```text
lib/accelerated/x86/hmac-x86-ssse3.c:280 ctx.setkey(&ctx, key_size, key)
lib/hash_int.c:201 _gnutls_mac_fast(...)
lib/crypto-api.c:803 gnutls_hmac_fast(...)
```
This is a negative-argument API robustness issue: the reproducer passes `NULL + nonzero key length`.
## Version of gnutls used:
```text
Upstream origin/master
Commit: 0b9fcb47c734191695b7b7812a0ba30a5c712b9f
Commit date: 2026-06-02 10:05:44 +0900
Configure summary version: 3.8.13 shared 72:0:42
```
## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)
```text
Upstream source build, not a distribution package.
Built locally on Ubuntu with glibc 2.39.
```
## How reproducible:
```text
Always reproducible with the harness when GNUTLS_CPUID_OVERRIDE=0x4 is used to select the x86 SSSE3 backend.
```
Steps to Reproduce:
* Build GnuTLS from the commit above with hardening and sanitizers:
```text
CPPFLAGS=-D_FORTIFY_SOURCE=3
CFLAGS=-O2 -g -fno-omit-frame-pointer -fsanitize=address,undefined -fstack-protector-strong -fPIE
LDFLAGS=-fsanitize=address,undefined -Wl,-z,relro -Wl,-z,now -pie
```
The verified library was:
```text
<build-dir>/lib/.libs/libgnutls.so.30.42.0
SHA-256: 224c60682088ac07680c1eba04acd159b51bd8995bedcbc1fc288fe248a1058b
```
* Compile the reproducer:
Reproducer source: [hmac_null_poc.c](https://github.com/Bin-infinite/vuln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/latest/%63%61%73%65%2D004/pocs/hmac_null_poc.c)
The core call is:
```c
gnutls_hmac_fast(GNUTLS_MAC_SHA1, NULL, 16, text, sizeof(text), digest);
```
* Run the reproducer:
```bash
ASAN_OPTIONS='abort_on_error=1:symbolize=1:detect_leaks=0:allocator_may_return_null=1' \
UBSAN_OPTIONS='halt_on_error=0:print_stacktrace=1' \
LSAN_OPTIONS='detect_leaks=0' \
GNUTLS_CPUID_OVERRIDE=0x4 \
./hmac_null_poc key-null
```
## Actual results:
ASan reports a NULL read:
```text
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
The signal is caused by a READ memory access.
#0 nettle_memxor nettle-3.10.2-nofat/memxor.s:164
#1 wrap_x86_hmac_fast lib/accelerated/x86/hmac-x86-ssse3.c:280
#2 _gnutls_mac_fast lib/hash_int.c:201
#3 gnutls_hmac_fast lib/crypto-api.c:803
#4 main hmac_null_poc.c
```
The same run also emits a UBSan function-pointer type diagnostic at the backend call site before ASan reports the NULL read.
Full log: [hmac_key_null_run1.stderr.txt](https://github.com/Bin-infinite/vuln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/latest/%63%61%73%65%2D004/runs/hmac_key_null_run1.stderr.txt)
## Expected results:
`gnutls_hmac_fast()` should reject `key == NULL && keylen > 0` with a negative error code, such as `GNUTLS_E_INVALID_REQUEST`, before invoking backend callbacks. Related NULL argument combinations should be validated centrally so all MAC providers behave consistently.
--
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1898
You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/5-6gv0gi0repn03bw1cy2iz30zu-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help
----==_mimepart_6a21c44c22bde_3719445c3098ef
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www=
.w3.org/TR/REC-html40/loose.dtd">
<html lang=3D"en" style=3D'--code-editor-font: var(--default-mono-font, "=
GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, =
Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospac=
e;'>
<head>
<meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Type">=
<title>
GitLab
</title>
<style data-premailer=3D"ignore" type=3D"text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Ro=
boto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Colo=
r Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size=
: inherit;
}
</style>
</head>
<body style=3D'font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.0=
1) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"=
Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif=
,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji=
";'>
<div class=3D"content">
<p class=3D"details" style=3D"font-style: italic; color: #626168;">
Issue created by <a href=3D"https://gitlab.com/Keryer">Kery</a>: <a href=3D=
"https://gitlab.com/gnutls/gnutls/-/work_items/1898">#1898</a>
</p>
<div class=3D"md" style=3D"position: relative; z-index: 1; color: #3a383f=
; word-wrap: break-word;">
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">This report was generated with AI assistance and manually verifi=
ed.</p>
<h2 id=3D"user-content-description-of-problem" dir=3D"auto" style=3D"marg=
in-top: 20px; margin-bottom: 10px;" align=3D"initial">Description of prob=
lem:<a href=3D"#description-of-problem" aria-label=3D"Link to heading 'De=
scription of problem:'" data-heading-content=3D"Description of problem:" =
class=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The exported API <code style=3D'font-size: 90%; color: #18171d; =
word-wrap: break-word; background-color: #ececef; border-radius: .25rem; =
margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-s=
pace: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo"=
, "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Cour=
ier New", "andale mono", "lucida console", monospace; font-variant-ligatu=
res: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_hmac_=
fast()</code> can dispatch to the x86 SSSE3 HMAC backend with <code style=
=3D'font-size: 90%; color: #18171d; word-wrap: break-word; background-col=
or: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: =
break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBr=
ains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "=
Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; =
font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.2=
5rem;'>key =3D=3D NULL</code> and <code style=3D'font-size: 90%; color: #=
18171d; word-wrap: break-word; background-color: #ececef; border-radius: =
.25rem; font-weight: inherit; overflow-wrap: break-word; white-space: bre=
ak-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu=
Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New",=
"andale mono", "lucida console", monospace; font-variant-ligatures: none=
; word-break: keep-all; padding: 0.125rem 0.25rem;'>keylen > 0</code>.=
The internal backend <code style=3D'font-size: 90%; color: #18171d; word=
-wrap: break-word; background-color: #ececef; border-radius: .25rem; font=
-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; f=
ont-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono",=
"Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mon=
o", "lucida console", monospace; font-variant-ligatures: none; word-break=
: keep-all; padding: 0.125rem 0.25rem;'>wrap_x86_hmac_fast()</code> forwa=
rds the unchecked key pointer to <code style=3D'font-size: 90%; color: #1=
8171d; word-wrap: break-word; background-color: #ececef; border-radius: .=
25rem; font-weight: inherit; overflow-wrap: break-word; white-space: brea=
k-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu =
Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", =
"andale mono", "lucida console", monospace; font-variant-ligatures: none;=
word-break: keep-all; padding: 0.125rem 0.25rem;'>ctx.setkey()</code>, c=
ausing a NULL pointer read.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The harness calls the exported <code style=3D'font-size: 90%; co=
lor: #18171d; word-wrap: break-word; background-color: #ececef; border-ra=
dius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break=
-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains =
Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubunt=
u Mono", "Courier New", "andale mono", "lucida console", monospace; font-=
variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;=
'>gnutls_hmac_fast()</code> API. It does not directly call the internal s=
tatic function.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Affected code:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">lib/accelerated/x86/hmac-x86-ssse3.c:280 ctx.setkey(&ctx, k=
ey_size, key)</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">lib/hash_int.c:201 =
_gnutls_mac_fast(...)</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">lib/crypto-api.c:803 =
gnutls_hmac_fast(...)</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">This is a negative-argument API robustness issue: the reproducer=
passes <code style=3D'font-size: 90%; color: #18171d; word-wrap: break-w=
ord; background-color: #ececef; border-radius: .25rem; margin-top: 0px; f=
ont-weight: inherit; overflow-wrap: break-word; white-space: break-spaces=
; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mon=
o", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale =
mono", "lucida console", monospace; font-variant-ligatures: none; word-br=
eak: keep-all; padding: 0.125rem 0.25rem;'>NULL + nonzero key length</cod=
e>.</p>
<h2 id=3D"user-content-version-of-gnutls-used" dir=3D"auto" style=3D"marg=
in-top: 20px; margin-bottom: 10px;" align=3D"initial">Version of gnutls u=
sed:<a href=3D"#version-of-gnutls-used" aria-label=3D"Link to heading 'Ve=
rsion of gnutls used:'" data-heading-content=3D"Version of gnutls used:" =
class=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Upstream origin/master</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">Commit: 0b9fcb47c73419=
1695b7b7812a0ba30a5c712b9f</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">Commit date: 2026-06-0=
2 10:05:44 +0900</span>
<span id=3D"LC4" class=3D"line" lang=3D"plaintext">Configure summary vers=
ion: 3.8.13 shared 72:0:42</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" dir=3D=
"auto" style=3D"margin-top: 20px; margin-bottom: 10px;" align=3D"initial"=
>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)<a href=3D"#distributo=
r-of-gnutls-eg-ubuntu-fedora-rhel" aria-label=3D"Link to heading 'Distrib=
utor of gnutls (e.g., Ubuntu, Fedora, RHEL)'" data-heading-content=3D"Dis=
tributor of gnutls (e.g., Ubuntu, Fedora, RHEL)" class=3D"anchor" style=3D=
"margin-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Upstream source build, not a distribution package.</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">Built locally on Ubunt=
u with glibc 2.39.</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-how-reproducible" dir=3D"auto" style=3D"margin-top=
: 20px; margin-bottom: 10px;" align=3D"initial">How reproducible:<a href=3D=
"#how-reproducible" aria-label=3D"Link to heading 'How reproducible:'" da=
ta-heading-content=3D"How reproducible:" class=3D"anchor" style=3D"margin=
-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Always reproducible with the harness when GNUTLS_CPUID_OVERRIDE=3D=
0x4 is used to select the x86 SSSE3 backend.</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Steps to Reproduce:</p>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Build GnuTLS from the commit above with hardening and san=
itizers:</li>
</ul>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">CPPFLAGS=3D-D_FORTIFY_SOURCE=3D3</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">CFLAGS=3D-O2 -g -fno-o=
mit-frame-pointer -fsanitize=3Daddress,undefined -fstack-protector-strong=
-fPIE</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">LDFLAGS=3D-fsanitize=3D=
address,undefined -Wl,-z,relro -Wl,-z,now -pie</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The verified library was:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;"><build-dir>/lib/.libs/libgnutls.so.30.42.0</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">SHA-256: 224c60682088a=
c07680c1eba04acd159b51bd8995bedcbc1fc288fe248a1058b</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Compile the reproducer:</li>
</ul>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Reproducer source: <a href=3D"https://github.com/Bin-infinite/vu=
ln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/lates=
t/%63%61%73%65%2D004/pocs/hmac_null_poc.c" rel=3D"nofollow noreferrer noo=
pener" target=3D"_blank" style=3D"margin-top: 0px;">hmac_null_poc.c</a></=
p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The core call is:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"c" class=3D"code highlight js-syntax-highligh=
t language-c" v-pre=3D"true" style=3D'display: block; font-size: 14px; co=
lor: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem=
; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menl=
o", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Co=
urier New", "andale mono", "lucida console", monospace; font-variant-liga=
tures: none; word-break: break-all; word-wrap: break-word; background-col=
or: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde=
;'><code style=3D'font-size: inherit; color: inherit; word-wrap: normal; =
word-break: keep-all; background-color: inherit; border-radius: .25rem; w=
hite-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains =
Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubunt=
u Mono", "Courier New", "andale mono", "lucida console", monospace; font-=
variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id=
=3D"LC1" class=3D"line" lang=3D"c" style=3D"margin-top: 0px;"><span class=
=3D"n" style=3D"margin-top: 0px;">gnutls_hmac_fast</span><span class=3D"p=
">(</span><span class=3D"n">GNUTLS_MAC_SHA1</span><span class=3D"p">,</sp=
an> <span class=3D"nb">NULL</span><span class=3D"p">,</span> <span class=3D=
"mi">16</span><span class=3D"p">,</span> <span class=3D"n">text</span><sp=
an class=3D"p">,</span> <span class=3D"k">sizeof</span><span class=3D"p">=
(</span><span class=3D"n">text</span><span class=3D"p">),</span> <span cl=
ass=3D"n">digest</span><span class=3D"p">);</span></span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Run the reproducer:</li>
</ul>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"bash" class=3D"code highlight js-syntax-highl=
ight language-shell" v-pre=3D"true" style=3D'display: block; font-size: 1=
4px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius:=
.25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono"=
, "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mon=
o", "Courier New", "andale mono", "lucida console", monospace; font-varia=
nt-ligatures: none; word-break: break-all; word-wrap: break-word; backgro=
und-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid =
#dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wrap: n=
ormal; word-break: keep-all; background-color: inherit; border-radius: .2=
5rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "Jet=
Brains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas",=
"Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace=
; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><=
span id=3D"LC1" class=3D"line" lang=3D"shell" style=3D"margin-top: 0px;">=
<span class=3D"nv" style=3D"margin-top: 0px;">ASAN_OPTIONS</span><span cl=
ass=3D"o">=3D</span><span class=3D"s1">'abort_on_error=3D1:symbolize=3D1:=
detect_leaks=3D0:allocator_may_return_null=3D1'</span> <span class=3D"se"=
>\</span></span>
<span id=3D"LC2" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">UBSAN_OPTIONS</span><span class=3D"o">=3D</span><span =
class=3D"s1">'halt_on_error=3D0:print_stacktrace=3D1'</span> <span class=3D=
"se">\</span></span>
<span id=3D"LC3" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">LSAN_OPTIONS</span><span class=3D"o">=3D</span><span c=
lass=3D"s1">'detect_leaks=3D0'</span> <span class=3D"se">\</span></span>
<span id=3D"LC4" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">GNUTLS_CPUID_OVERRIDE</span><span class=3D"o">=3D</spa=
n>0x4 <span class=3D"se">\</span></span>
<span id=3D"LC5" class=3D"line" lang=3D"shell">./hmac_null_poc key-null</=
span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-actual-results" dir=3D"auto" style=3D"margin-top: =
20px; margin-bottom: 10px;" align=3D"initial">Actual results:<a href=3D"#=
actual-results" aria-label=3D"Link to heading 'Actual results:'" data-hea=
ding-content=3D"Actual results:" class=3D"anchor" style=3D"margin-top: 0p=
x;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">ASan reports a NULL read:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000</=
span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">The signal is caused b=
y a READ memory access.</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">#0 nettle_memxor nettl=
e-3.10.2-nofat/memxor.s:164</span>
<span id=3D"LC4" class=3D"line" lang=3D"plaintext">#1 wrap_x86_hmac_fast =
lib/accelerated/x86/hmac-x86-ssse3.c:280</span>
<span id=3D"LC5" class=3D"line" lang=3D"plaintext">#2 _gnutls_mac_fast li=
b/hash_int.c:201</span>
<span id=3D"LC6" class=3D"line" lang=3D"plaintext">#3 gnutls_hmac_fast li=
b/crypto-api.c:803</span>
<span id=3D"LC7" class=3D"line" lang=3D"plaintext">#4 main hmac_null_poc.=
c</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The same run also emits a UBSan function-pointer type diagnostic=
at the backend call site before ASan reports the NULL read.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Full log: <a href=3D"https://github.com/Bin-infinite/vuln-valida=
tions/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/latest/%63%61%=
73%65%2D004/runs/hmac_key_null_run1.stderr.txt" rel=3D"nofollow noreferre=
r noopener" target=3D"_blank" style=3D"margin-top: 0px;">hmac_key_null_ru=
n1.stderr.txt</a></p>
<h2 id=3D"user-content-expected-results" dir=3D"auto" style=3D"margin-top=
: 20px; margin-bottom: 10px;" align=3D"initial">Expected results:<a href=3D=
"#expected-results" aria-label=3D"Link to heading 'Expected results:'" da=
ta-heading-content=3D"Expected results:" class=3D"anchor" style=3D"margin=
-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px;" align=3D"initial">=
<code style=3D'font-size: 90%; color: #18171d; word-wrap: break-word; bac=
kground-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weig=
ht: inherit; overflow-wrap: break-word; white-space: break-spaces; font-f=
amily: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Lib=
eration Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "=
lucida console", monospace; font-variant-ligatures: none; word-break: kee=
p-all; padding: 0.125rem 0.25rem;'>gnutls_hmac_fast()</code> should rejec=
t <code style=3D'font-size: 90%; color: #18171d; word-wrap: break-word; b=
ackground-color: #ececef; border-radius: .25rem; font-weight: inherit; ov=
erflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab =
Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", =
"Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console"=
, monospace; font-variant-ligatures: none; word-break: keep-all; padding:=
0.125rem 0.25rem;'>key =3D=3D NULL && keylen > 0</code> with =
a negative error code, such as <code style=3D'font-size: 90%; color: #181=
71d; word-wrap: break-word; background-color: #ececef; border-radius: .25=
rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-=
spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sa=
ns Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "a=
ndale mono", "lucida console", monospace; font-variant-ligatures: none; w=
ord-break: keep-all; padding: 0.125rem 0.25rem;'>GNUTLS_E_INVALID_REQUEST=
</code>, before invoking backend callbacks. Related NULL argument combina=
tions should be validated centrally so all MAC providers behave consisten=
tly.</p>
</div>
</div>
<div class=3D"footer" style=3D"margin-top: 10px;">
<p style=3D"font-size: small; color: #626168;">
=E2=80=94
<br>
Reply to this email directly or <a href=3D"https://gitlab.com/gnutls/gnut=
ls/-/work_items/1898">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target=3D"_blan=
k" rel=3D"noopener noreferrer" href=3D"https://gitlab.com">gitlab.com</a>=
. <a href=3D"https://gitlab.com/-/sent_notifications/5-6gv0gi0repn03bw1cy=
2iz30zu-a84t7/unsubscribe" target=3D"_blank" rel=3D"noopener noreferrer">=
Unsubscribe</a> from this thread =C2=B7 <a href=3D"https://gitlab.com/-/p=
rofile/notifications" target=3D"_blank" rel=3D"noopener noreferrer" class=
=3D"mng-notif-link">Manage all notifications</a> =C2=B7 <a href=3D"https:=
//gitlab.com/help" target=3D"_blank" rel=3D"noopener noreferrer" class=3D=
"help-link">Help</a>
<span style=3D"color: transparent; font-size: 0; display: none; overflow:=
hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/work_it=
ems/1898 at 1780597836
</span>
<script type=3D"application/ld+json">{"@context":"http://schema.org","@ty=
pe":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item"=
,"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1898"}}</script>
</p>
</div>
</body>
</html>
----==_mimepart_6a21c44c22bde_3719445c3098ef--
--===============0425901405998885604==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Gnutls-devel mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-devel
--===============0425901405998885604==--