mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-14 08:47:51 +04:00
Hauke Mehrtens
c9e33c7467
OpenSSL 3.5.8 fixes zero-length message handling for AES-GCM-SIV
upstream with commit bdeb0cd994d9 ("Check the tag on EVP_Cipher()
finalize: Poly1305 and OCB AEADs", CVE-2026-75803, backport of
5741d29a5f35): aes_gcm_siv_finish() now generates the tag when the
finalization is the first empty-message operation.
That makes the cipher_aes_gcm_siv.c hunk of our local patch redundant,
and worse than redundant. By substituting the address of an empty
object for the NULL input pointer it keeps routing the terminal
EVP_Cipher(ctx, out, NULL, 0) call to aes_gcm_siv_encrypt()/
aes_gcm_siv_decrypt() instead of aes_gcm_siv_finish(), so the tag
supplied by the caller is never compared and a forged tag is accepted.
That is the hole the upstream commit closes.
Measured against a locally built 3.5.8; the EVP_Cipher() return value
is a byte count, so 0 means the tag was accepted and -1 means it was
rejected:
decrypt empty msg EVP_Cipher(out, NULL, 0)
genuine forged genuine forged
3.5.8 vanilla ok rejected 0 -1
3.5.8 + patch 010 ok rejected 0 0 <- bad
3.5.8 + this commit ok rejected 0 -1
AES-SIV has no equivalent fix in 3.5.8 or in openssl master, and
without the second hunk a zero-length message cannot be encrypted at
all, so keep that hunk and rename the patch to match what is left.
Fixes: 2bc7978323 ("openssl: fix AES-GCM-SIV and AES-SIV with zero-length messages")
Assisted-by: Claude:claude-opus-5
Link: https://github.com/openwrt/openwrt/pull/24944
(cherry picked from commit bacf308ec0)
Link: https://github.com/openwrt/openwrt/pull/25326
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>