Sangrando corazones criptográficos: Deconstruyendo la vulnerabilidad de OpenSSL

Versiones vulnerables y versiones corregidas

Heartbeat contra Heartbleed

¿Cuál es la vulnerabilidad?

Talk is cheap, show me the code

int tls1_process_heartbeat(SSL *s)
 {
 unsigned char *p = &s->s3->rrec.data[0], *pl;
 unsigned short hbtype;
 unsigned int payload;
 unsigned int padding = 16; /* Use minimum padding */

 /* Read type and payload length first */
 hbtype = *p++;
 n2s(p, payload);
 pl = p;

 if (s->msg_callback)
  s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
   &s->s3->rrec.data[0], s->s3->rrec.length,
   s, s->msg_callback_arg);

 if (hbtype == TLS1_HB_REQUEST)
  {
  unsigned char *buffer, *bp;
  int r;

  /* Allocate memory for the response, size is 1 bytes
   * message type, plus 2 bytes payload length, plus
   * payload, plus padding
   */
  buffer = OPENSSL_malloc(1 + 2 + payload + padding);
  bp = buffer;
  
  /* Enter response type, length and copy payload */
  *bp++ = TLS1_HB_RESPONSE;
  s2n(payload, bp);
  memcpy(bp, pl, payload);
  bp += payload;
  /* Random padding */
  RAND_pseudo_bytes(bp, padding);

  r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload 

                + padding);

  if (r >= 0 && s->msg_callback)
   s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
    buffer, 3 + payload + padding,
    s, s->msg_callback_arg);

  OPENSSL_free(buffer);

  if (r < 0)
   return r;
  }
 else if (hbtype == TLS1_HB_RESPONSE)
  {
  unsigned int seq;
  
  /* We only send sequence numbers (2 bytes unsigned int),
   * and 16 random bytes, so we just try to read the
   * sequence number */
  n2s(pl, seq);
  
  if (payload == 18 && seq == s->tlsext_hb_seq)
   {
   s->tlsext_hb_seq++;
   s->tlsext_hb_pending = 0;
   }
  }

 return 0;
 }
                           [ssl/t1_lib.c:2481]

/* Read type and payload length first */
hbtype = *p++;
n2s(p, payload);
pl = p;
                            [ssl/t1_lib.c:2489]

#define n2s(c,s)        ((s=(((unsigned int)(c[0]))<< 8)| \
                            (((unsigned int)(c[1]))    )),c+=2)
                            [ssl/ssl_locl.h:249]

if (hbtype == TLS1_HB_REQUEST)
    {
    unsigned char *buffer, *bp;
    int r;

    /* Allocate memory for the response, size is 1 bytes
     * message type, plus 2 bytes payload length, plus
     * payload, plus padding
     */
    buffer = OPENSSL_malloc(1 + 2 + payload + padding);
    bp = buffer;
    
    /* Enter response type, length and copy payload */
    *bp++ = TLS1_HB_RESPONSE;
    s2n(payload, bp);
    memcpy(bp, pl, payload);
    bp += payload;
    /* Random padding */
    RAND_pseudo_bytes(bp, padding);

    r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);

    if (r >= 0 && s->msg_callback)
        s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
            buffer, 3 + payload + padding,
            s, s->msg_callback_arg);

    OPENSSL_free(buffer);

    if (r < 0)
        return r;
    }
                            [ssl/ssl_locl.h:2499]

buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;
                            [ssl/ssl_locl.h:2508]

/* Enter response type, length and copy payload */
*bp++ = TLS1_HB_RESPONSE;
s2n(payload, bp);
memcpy(bp, pl, payload);
bp += payload;
/* Random padding */
RAND_pseudo_bytes(bp, padding);
                            [ssl/ssl_locl.h:2511]

unsigned char *p = &s->s3->rrec.data[0], *pl;
(...)
pl = p;
                            [ssl/ssl_locl.h:2584,2592]

Limitaciones

struct {
    HeartbeatMessageType type;
    uint16 payload_length;
    opaque payload[HeartbeatMessage.payload_length];
    opaque padding[padding_length];
} HeartbeatMessage;

 typedef struct ssl_st SSL;
                    [include/openssl/ossl_typ.h:172]

struct ssl_st
        {
        (...)
        struct ssl3_state_st *s3; /* SSLv3 variables */
        (...)
        }
                     [include/openssl/ssl.h:1105]

typedef struct ssl3_state_st
        {
        (...)
        SSL3_RECORD rrec;       /* each decoded record goes in here */
        (...)
        }
                      [include/openssl/ssl3.h:405]

typedef struct ssl3_record_st
        {
/*r */  int type;               /* type of record */
/*rw*/  unsigned int length;    /* How many bytes available */
/*r */  unsigned int off;       /* read/write offset into 'buf' */
/*rw*/  unsigned char *data;    /* pointer to the record data */
/*rw*/  unsigned char *input;   /* where the decode bytes are */
/*r */  unsigned char *comp;    /* only used with decompression - malloc()ed */
/*r */  unsigned long epoch;    /* epoch number, needed by DTLS1 */
/*r */  unsigned char seq_num[8]; /* sequence number, needed by DTLS1 */
        } SSL3_RECORD; 

                       [include/openssl/ssl3.h:348]

int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
        {
 (...)
        if (s->s3->rbuf.buf == NULL) /* Not initialized yet */
                if (!ssl3_setup_read_buffer(s))
                        return(-1);
 (...)
 }
                        [ssl/s3_pkt.c:941]


int ssl3_setup_read_buffer(SSL *s)
        {
 (...)
 if (s->s3->rbuf.buf == NULL)
 {
 (...)
 if ((p=freelist_extract(s->ctx, 1, len)) == NULL)
  goto err;
 s->s3->rbuf.buf = p;
 s->s3->rbuf.len = len;
 }

 s->packet= &(s->s3->rbuf.buf[0]);
 return 1;
 (...)
 }
                       [ssl/s3_both.c:736]

Para acabar…

Referencias