]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
heimdal: Fix CVE-2022-4152, signature validation error
authorCy Schubert <cy@FreeBSD.org>
Fri, 10 Mar 2023 01:03:52 +0000 (17:03 -0800)
committerEd Maste <emaste@FreeBSD.org>
Thu, 16 Mar 2023 17:44:41 +0000 (13:44 -0400)
commit08ffa93d9f0e5c03b15e6f3326d5a0056bfc4a52
treefbd54cdeb963812d7eeb31b86aa8bb03175c528c
parent61dad7633cd3eeacd734cdb0338331b751bd6ab0
heimdal: Fix CVE-2022-4152, signature validation error

When CVE-2022-3437 was fixed by changing memcmp to be a constant
time and the workaround for th e compiler was to add "!=0". However
the logic implmented was inverted resulting in CVE-2022-4152.

Reported by: Timothy E Zingelman <zingelman _AT_ fnal.gov>
Security: CVE-2022-4152
Security: https://www.cve.org/CVERecord?id=CVE-2022-45142
Security: https://nvd.nist.gov/vuln/detail/CVE-2022-45142
Security: https://security-tracker.debian.org/tracker/CVE-2022-45142
Security: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2022-45142
Security: https://bugzilla.samba.org/show_bug.cgi?id=15296
Security: https://www.openwall.com/lists/oss-security/2023/02/08/1
Approved by: re (cperciva)

(cherry picked from commit 5abaf0866445a61c11665fffc148ecd13a7bb9ac)
(cherry picked from commit 59c26d1a95a00418892e08341e3eae074c238680)
crypto/heimdal/lib/gssapi/krb5/arcfour.c