qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-22 09:34:54 -07:00
Code Releases Activity

crypto/x509: make sure pub key is non-nil before interface conversion

Browse Source 
alreadyInChain assumes all keys fit a interface which contains the
Equal method (which they do), but this ignores that certificates may
have a nil key when PublicKeyAlgorithm is UnknownPublicKeyAlgorithm. In
this case alreadyInChain panics.

Check that the key is non-nil as part of considerCandidate (we are never
going to build a chain containing UnknownPublicKeyAlgorithm anyway).

Fixes #65390
Fixes CVE-2024-24783

Change-Id: Ibdccc0a487e3368b6812be35daad2512220243f3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2137282
Reviewed-by: Damien Neil <dneil@google.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/569339
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
This commit is contained in:
Roland Shoemaker 2024-01-18 12:51:13 -08:00 committed by Gopher Robot
parent 5e387b2fee
commit afb105056d
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/crypto/x509/verify.go
View File

@ -899,7 +899,7 @@ func (c *Certificate) buildChains(currentChain []*Certificate, sigChecks *int, o
)
considerCandidate := func(certType int, candidate potentialParent) {
if alreadyInChain(candidate.cert, currentChain) {
if candidate.cert.PublicKey == nil || alreadyInChain(candidate.cert, currentChain) {
return
}

19
src/crypto/x509/verify_test.go
View File

@ -2792,3 +2792,22 @@ func TestVerifyEKURootAsLeaf(t *testing.T) {
}
}
func TestVerifyNilPubKey(t *testing.T) {
c := &Certificate{
RawIssuer: []byte{1, 2, 3},
AuthorityKeyId: []byte{1, 2, 3},
}
opts := &VerifyOptions{}
opts.Roots = NewCertPool()
r := &Certificate{
RawSubject: []byte{1, 2, 3},
SubjectKeyId: []byte{1, 2, 3},
}
opts.Roots.AddCert(r)
_, err := c.buildChains([]*Certificate{r}, nil, opts)
if _, ok := err.(UnknownAuthorityError); !ok {
t.Fatalf("buildChains returned unexpected error, got: %v, want %v", err, UnknownAuthorityError{})
}
}