[DPDK/cryptodev Bug 1987] OpenSSL AES-128-CBC encryption with scatter-gather buffer overflow

[DPDK/cryptodev Bug 1987] OpenSSL AES-128-CBC encryption with scatter-gather buffer overflow

[bugzilla]

https://bugs.dpdk.org/show_bug.cgi?id=1987

            Bug ID: 1987
           Summary: OpenSSL AES-128-CBC encryption with scatter-gather
                    buffer overflow
           Product: DPDK
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: cryptodev
          Assignee: dev@dpdk.org
          Reporter: thomas@monjalon.net
  Target Milestone: ---
             Group: security

Report date: 2025-02-20
Reported by: Gowtham Suresh Kumar <Gowtham.SureshKumar@arm.com>

Subject: Security Vulnerability: Buffer Overflow in DPDK function
process_openssl_encryption_update() for segmented in-place operations

Dear DPDK Security Team,

I would like to report a buffer overflow vulnerability in DPDK that occurs in
AES-128-CBC Encryption with Scatter-Gather, Inplace configuration for a
particular corner case. This issue leads to out-of-bounds writes, potentially
overwriting sensitive information such as plaintext or ciphertext outside the
allocated buffer.
Issue Description:

The vulnerability can be reproduced by modifying sgl_segs parameter in
AES-128-CBC Encryption Scatter-Gather (Inplace) test case increasing the
segment count from 3 to 128, in test_cryptodev_aes_test_vectors.h. When using
small segment sizes (e.g., 4 bytes per segment), incorrect pointer handling
results in OpenSSL writing ciphertext outside the expected buffer bounds.

Key Findings:
- Incorrect Pointer Updates: The dst pointer is updated incorrectly across
consecutive EVP_EncryptUpdate() calls, even when OpenSSL buffers input instead
of producing immediate ciphertext.
- Buffer Overflow in EVP_Final(): When OpenSSL finally encrypts the accumulated
data, it writes beyond the allocated buffer, overwriting adjacent memory.
- Segment Size Dependency: The issue occurs for small segment sizes
specifically when sizes of consecutive segments together is smaller than block
size of the cipher

Root Cause Analysis:
- dst pointer is updated incorrectly even when OpenSSL does not generate output
(outl = 0).
- Small segments cause OpenSSL to delay encryption, leading to misalignment in
buffer usage.
- On final encryption (EVP_Final()), OpenSSL writes ciphertext at an incorrect
memory location, causing a buffer overflow.

Impact & Security Concerns:
This issue presents a critical security risk, as it allows OpenSSL to:
- Write sensitive plaintext or ciphertext outside the allocated buffer,
potentially exposing cryptographic data.
- Corrupt adjacent memory, leading to unpredictable behavior or crashes.
- Introduce vulnerabilities that could be exploited depending on the deployment
context.

Proposed Fix:
- Modify process_openssl_encryption_update() to ensure dst pointer is updated
only when valid ciphertext is produced.
- Introduce additional checks to prevent buffer overflows when segment sizes
are small.
- Expand test cases to include non-block-aligned segment sizes to detect
similar issues.

-- 
You are receiving this mail because:
You are the assignee for the bug.