Wind River Support Network

Summary

Wind River Security Vulnerability Notice: CVE-2020-1967 of openssl

---

Affected Product Versions

Wind River Linux LTS 19, Wind River Linux LTS 18

---

Description

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Reported by Bernd Edlinger.

For more information, consult NVD at https://nvd.nist.gov/vuln/detail/CVE-2020-1967.

What software is known to be affected by this CVE?

openssl 1.1.1d ~ 1.1.1f

Is Wind River Linux affected by this CVE issue?

WRLinux LTS-18 and LTS-19 are affected on it, all earlier releases have no this issue.

NOTE: LTS-18 supports several openssl versions, only 1.1.1d is affected.

Mitigation

Upstream commit eb563247 of openssl fixed it:

https://github.com/openssl/openssl/commit/eb563247aef3e83dda7679c43f9649270462e5b1

This commit can be integrated into openssl source tree of LTS-18/19 directly:

# cd PATH_2_SOURCE
# git clone git://git.openssl.org/openssl.git
# cd  openssl
# git format-patch eb563247a -1
0001-Fix-NULL-dereference-in-SSL_check_chain-for-TLS-1.3.patch
# cd PATH_2_PROJ/SOURCE_CODE_of_openssl
# patch -p1 <PATH_2_SOURCE/openssl/0001-Fix-NULL-dereference-in-SSL_check_chain-for-TLS-1.3.patch

...

Wind River will continue to monitor the various Open Source projects and will incorporate fixes as appropriate to supported products.

---