Merge branch 'timing-leak-fix' into 'master'

auth/rsa: side-step potential side-channel

Closes #1050

See merge request gnutls/gnutls!1698

2 files changed, 7 insertions, 27 deletions

diff --git a/NEWS b/NEWS
index a060176b0f..35212bba80 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,10 @@ See the end for copying conditions.
 
 * Version 3.8.0 (unreleased ????-??-??)
 
+** libgnutls: Fix a Bleichenbacher oracle in the TLS RSA key exchange.
+   Reported by Hubert Kario (#1050). Fix developed by Alexander Sosedkin.
+   [GNUTLS-SA-2020-07-14, CVSS: medium] [CVE-2023-0361]
+
 ** guile: Guile-bindings removed.
 They have been extracted into a separate project to reduce complexity
 and to simplify maintenance, see <https://gitlab.com/gnutls/guile/>.
diff --git a/lib/auth/rsa.c b/lib/auth/rsa.c
index 62c86e470a..492ec119fa 100644
--- a/lib/auth/rsa.c
+++ b/lib/auth/rsa.c
@@ -154,13 +154,10 @@ _gnutls_get_public_rsa_params(gnutls_session_t session,
 static int
 proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, size_t _data_size)
 {
-	const char attack_error[] = "auth_rsa: Possible PKCS #1 attack\n";
 	gnutls_datum_t ciphertext;
 	int ret, dsize;
 	ssize_t data_size = _data_size;
 	volatile uint8_t ver_maj, ver_min;
-	volatile uint8_t check_ver_min;
-	volatile uint32_t ok;
 
 #ifdef ENABLE_SSL3
 	if (get_num_version(session) == GNUTLS_SSL3) {
@@ -186,7 +183,6 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, size_t _data_size)
 
 	ver_maj = _gnutls_get_adv_version_major(session);
 	ver_min = _gnutls_get_adv_version_minor(session);
-	check_ver_min = (session->internals.allow_wrong_pms == 0);
 
 	session->key.key.data = gnutls_malloc(GNUTLS_MASTER_SIZE);
 	if (session->key.key.data == NULL) {
@@ -205,10 +201,9 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, size_t _data_size)
 		return ret;
 	}
 
-	ret =
-	    gnutls_privkey_decrypt_data2(session->internals.selected_key,
-					 0, &ciphertext, session->key.key.data,
-					 session->key.key.size);
+	gnutls_privkey_decrypt_data2(session->internals.selected_key,
+				     0, &ciphertext, session->key.key.data,
+				     session->key.key.size);
 	/* After this point, any conditional on failure that cause differences
 	 * in execution may create a timing or cache access pattern side
 	 * channel that can be used as an oracle, so treat very carefully */
@@ -224,25 +219,6 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data, size_t _data_size)
 	 * Vlastimil Klima, Ondej Pokorny and Tomas Rosa.
 	 */
 
-	/* ok is 0 in case of error and 1 in case of success. */
-
-	/* if ret < 0 */
-	ok = CONSTCHECK_EQUAL(ret, 0);
-	/* session->key.key.data[0] must equal ver_maj */
-	ok &= CONSTCHECK_EQUAL(session->key.key.data[0], ver_maj);
-	/* if check_ver_min then session->key.key.data[1] must equal ver_min */
-	ok &= CONSTCHECK_NOT_EQUAL(check_ver_min, 0) &
-	    CONSTCHECK_EQUAL(session->key.key.data[1], ver_min);
-
-	if (ok) {
-		/* call logging function unconditionally so all branches are
-		 * indistinguishable for timing and cache access when debug
-		 * logging is disabled */
-		_gnutls_no_log("%s", attack_error);
-	} else {
-		_gnutls_debug_log("%s", attack_error);
-	}
-
 	/* This is here to avoid the version check attack
 	 * discussed above.
 	 */