Re: about CVE-2024-6609 for nss 3.61 in Debian Bullseye

Hi Arturo, the note is correct. Here's the patch:

diff --git lib/freebl/ec.c lib/freebl/ec.c
--- lib/freebl/ec.c
+++ lib/freebl/ec.c
@@ -297,6 +297,10 @@ done:

 cleanup:
     mp_clear(&k);
+    if (err < MP_OKAY) {
+        MP_TO_SEC_ERROR(err);
+        rv =3D SECFailure;
+    }
     if (rv) {
         PORT_FreeArena(arena, PR_TRUE);
     }

Cheers,
John

On Wed, Sep 25, 2024 at 1:02=E2=80=AFPM Arturo Borrero Gonzalez
<[email protected]> wrote:
>
> Hi there,
>
> I'm interested in having a patch for CVE-2024-6609 available for the nss =
version we have in Debian Bullseye (nss 3.61).
>
> We have a note [0] that mentions this:
>
> =3D=3D=3D 8< =3D=3D=3D
> To address CVE in older versions of src:nss what is needed is to add the =
error
> handling code (confirmed by upstream):
> https://searchfox.org/nss/rev/ba9330537e6e94971de8b9bc49460891b23afd4f/li=
b/freebl/ec.c#379-382
> to the ec_NewKey function, in the cleanup section, after mp_clear and
> before `if (rv)`.
> =3D=3D=3D 8< =3D=3D=3D
>
> I was hoping that you could provide this patch yourself, because I don't =
think just a copy/paste (like the note seems to suggest), would be enough.
>
> Please, let me know if you can help with this.
>
> thanks, regards.
>
> [0] https://security-tracker.debian.org/tracker/CVE-2024-6609
>
>
> --
> You received this message because you are subscribed to the Google Groups=
 "[email protected]" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to [email protected].
> To view this discussion on the web visit https://groups.google.com/a/mozi=
lla.org/d/msgid/dev-tech-crypto/66071e21-a687-49f2-a709-5244a06438b6n%40moz=
illa.org.

--=20
You received this message because you are subscribed to the Google Groups "=
[email protected]" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion on the web visit https://groups.google.com/a/mozill=
a.org/d/msgid/dev-tech-crypto/CAFgAd7HgLjNvDz1NXOnjV2DYquYuOL3mtNZruCgAtGMP=
ddwE%2BA%40mail.gmail.com.