GnuTLS | Tautological assertion in pkcs11-mock4.c never validates initialization flags (#1902)
Read-only notification of GnuTLS library development activities <[email protected]> Tue, 09 Jun 2026 17:05:43 +0000
| Newsgroups | gmane.comp.encryption.gpg.gnutls.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============2596843725489547434==
Content-Type: multipart/alternative;
boundary="--==_mimepart_6a2847e716713_3721474e8443261";
charset=UTF-8
Content-Transfer-Encoding: 7bit
----==_mimepart_6a2847e716713_3721474e8443261
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Issue created by swathipanneerselvam: https://gitlab.com/gnutls/gnutls/-/=
work_items/1902
## Description of problem:
In tests/pkcs11/pkcs11-mock4.c (added in MR !2041 for CVE-2025-9820), the=
assertion checking C_Initialize flags is a no-op due to C operator prece=
dence:
c
assert(!(init_args->flags & LOCK_FLAGS) !=3D LOCK_FLAGS);
! binds tighter than !=3D, so this evaluates as (0 or 1) !=3D LOCK_FLAGS =
=E2=80=94 always true since LOCK_FLAGS is a multi-bit constant. The mock =
never actually validates the initialization behavior.
Fix should be either:
c
assert(!(init_args->flags & LOCK_FLAGS));
or:
c
assert((init_args->flags & LOCK_FLAGS) !=3D LOCK_FLAGS);
## Version of gnutls used:
3.8.10
## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)
Amazon Linux 2023 (found while rebasing from c9s)
## How reproducible:
Always =E2=80=94 the assertion is a compile-time tautology.
Steps to Reproduce:
* Build gnutls 3.8.10 with the CVE-2025-9820 patch applied
* Run the pkcs11/long-label test
* Observe that the assertion in override_C_Initialize passes regardless =
of what flags the caller sets
## Actual results:
Assertion always passes. The mock accepts any combination of initializati=
on flags without validating.
## Expected results:
Assertion should fail if the caller passes unexpected flags, validating t=
he expected 3.8.10 C_Initialize behavior as the comment in the code descr=
ibes.
-- =
Reply to this email directly or view it on GitLab: https://gitlab.com/gnu=
tls/gnutls/-/work_items/1902
You're receiving this email because of your account on gitlab.com. Unsubs=
cribe from this thread: https://gitlab.com/-/sent_notifications/5-dnoxcqa=
tf8ycow6mh1tsu8q41-a84t7/unsubscribe | Manage all notifications: https://=
gitlab.com/-/profile/notifications | Help: https://gitlab.com/help
----==_mimepart_6a2847e716713_3721474e8443261
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www=
.w3.org/TR/REC-html40/loose.dtd">
<html lang=3D"en" style=3D'--code-editor-font: var(--default-mono-font, "=
GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, =
Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospac=
e;'>
<head>
<meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Type">=
<title>
GitLab
</title>
<style data-premailer=3D"ignore" type=3D"text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Ro=
boto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Colo=
r Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size=
: inherit;
}
</style>
</head>
<body style=3D'font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.0=
1) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"=
Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif=
,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji=
";'>
<div class=3D"content">
<p class=3D"details" style=3D"font-style: italic; color: #626168;">
Issue created by <a href=3D"https://gitlab.com/swathipanneerselvam">swath=
ipanneerselvam</a>: <a href=3D"https://gitlab.com/gnutls/gnutls/-/work_it=
ems/1902">#1902</a>
</p>
<div class=3D"md" style=3D"position: relative; z-index: 1; color: #3a383f=
; word-wrap: break-word;">
<h2 id=3D"user-content-description-of-problem" dir=3D"auto" style=3D"marg=
in-top: 0px; margin-bottom: 10px;" align=3D"initial">Description of probl=
em:<a href=3D"#description-of-problem" aria-label=3D"Link to heading 'Des=
cription of problem:'" data-heading-content=3D"Description of problem:" c=
lass=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">In tests/pkcs11/pkcs11-mock4.c (added in MR <a href=3D"https://g=
itlab.com/gnutls/gnutls/-/merge_requests/2041" title=3D"Release 3.8.11" c=
lass=3D"gfm gfm-merge_request" data-original=3D"!2041" data-link=3D"false=
" data-link-reference=3D"false" data-merge-request=3D"433177349" data-pro=
ject=3D"179611" data-project-path=3D"gnutls/gnutls" data-iid=3D"2041" dat=
a-container=3D"body" data-placement=3D"top" data-reference-type=3D"merge_=
request" style=3D"margin-top: 0px;">!2041 (merged)</a> for CVE-2025-9820)=
, the assertion checking C_Initialize flags is a no-op due to C operator =
precedence:</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">c
assert(!(init_args->flags & LOCK_FLAGS) !=3D LOCK_FLAGS);</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">! binds tighter than !=3D, so this evaluates as (0 or 1) !=3D LO=
CK_FLAGS =E2=80=94 always true since LOCK_FLAGS is a multi-bit constant. =
The mock never actually validates the initialization behavior.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Fix should be either:
c
assert(!(init_args->flags & LOCK_FLAGS));</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">or:
c
assert((init_args->flags & LOCK_FLAGS) !=3D LOCK_FLAGS);</p>
<h2 id=3D"user-content-version-of-gnutls-used" dir=3D"auto" style=3D"marg=
in-top: 20px; margin-bottom: 10px;" align=3D"initial">Version of gnutls u=
sed:<a href=3D"#version-of-gnutls-used" aria-label=3D"Link to heading 'Ve=
rsion of gnutls used:'" data-heading-content=3D"Version of gnutls used:" =
class=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">3.8.10</p>
<h2 id=3D"user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" dir=3D=
"auto" style=3D"margin-top: 20px; margin-bottom: 10px;" align=3D"initial"=
>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)<a href=3D"#distributo=
r-of-gnutls-eg-ubuntu-fedora-rhel" aria-label=3D"Link to heading 'Distrib=
utor of gnutls (e.g., Ubuntu, Fedora, RHEL)'" data-heading-content=3D"Dis=
tributor of gnutls (e.g., Ubuntu, Fedora, RHEL)" class=3D"anchor" style=3D=
"margin-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Amazon Linux 2023 (found while rebasing from c9s)</p>
<h2 id=3D"user-content-how-reproducible" dir=3D"auto" style=3D"margin-top=
: 20px; margin-bottom: 10px;" align=3D"initial">How reproducible:<a href=3D=
"#how-reproducible" aria-label=3D"Link to heading 'How reproducible:'" da=
ta-heading-content=3D"How reproducible:" class=3D"anchor" style=3D"margin=
-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Always =E2=80=94 the assertion is a compile-time tautology.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Steps to Reproduce:</p>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Build gnutls 3.8.10 with the CVE-2025-9820 patch applied<=
/li>
<li style=3D"line-height: 1.6em; margin-left: 25px; padding-left: 3px;">R=
un the pkcs11/long-label test</li>
<li style=3D"line-height: 1.6em; margin-left: 25px; padding-left: 3px;">O=
bserve that the assertion in override_C_Initialize passes regardless of w=
hat flags the caller sets</li>
</ul>
<h2 id=3D"user-content-actual-results" dir=3D"auto" style=3D"margin-top: =
20px; margin-bottom: 10px;" align=3D"initial">Actual results:<a href=3D"#=
actual-results" aria-label=3D"Link to heading 'Actual results:'" data-hea=
ding-content=3D"Actual results:" class=3D"anchor" style=3D"margin-top: 0p=
x;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Assertion always passes. The mock accepts any combination of ini=
tialization flags without validating.</p>
<h2 id=3D"user-content-expected-results" dir=3D"auto" style=3D"margin-top=
: 20px; margin-bottom: 10px;" align=3D"initial">Expected results:<a href=3D=
"#expected-results" aria-label=3D"Link to heading 'Expected results:'" da=
ta-heading-content=3D"Expected results:" class=3D"anchor" style=3D"margin=
-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px;" align=3D"initial">=
Assertion should fail if the caller passes unexpected flags, validating t=
he expected 3.8.10 C_Initialize behavior as the comment in the code descr=
ibes.</p>
</div>
</div>
<div class=3D"footer" style=3D"margin-top: 10px;">
<p style=3D"font-size: small; color: #626168;">
=E2=80=94
<br>
Reply to this email directly or <a href=3D"https://gitlab.com/gnutls/gnut=
ls/-/work_items/1902">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target=3D"_blan=
k" rel=3D"noopener noreferrer" href=3D"https://gitlab.com">gitlab.com</a>=
. <a href=3D"https://gitlab.com/-/sent_notifications/5-dnoxcqatf8ycow6mh1=
tsu8q41-a84t7/unsubscribe" target=3D"_blank" rel=3D"noopener noreferrer">=
Unsubscribe</a> from this thread =C2=B7 <a href=3D"https://gitlab.com/-/p=
rofile/notifications" target=3D"_blank" rel=3D"noopener noreferrer" class=
=3D"mng-notif-link">Manage all notifications</a> =C2=B7 <a href=3D"https:=
//gitlab.com/help" target=3D"_blank" rel=3D"noopener noreferrer" class=3D=
"help-link">Help</a>
<span style=3D"color: transparent; font-size: 0; display: none; overflow:=
hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/work_it=
ems/1902 at 1781024743
</span>
<script type=3D"application/ld+json">{"@context":"http://schema.org","@ty=
pe":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item"=
,"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1902"}}</script>
</p>
</div>
</body>
</html>
----==_mimepart_6a2847e716713_3721474e8443261--
--===============2596843725489547434==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Gnutls-devel mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-devel
--===============2596843725489547434==--