From 4a9b66e8bd087190c4615f273a5e37075ce50205 Mon Sep 17 00:00:00 2001 From: Norbert Pocs Date: Tue, 12 May 2026 15:16:04 +0200 Subject: [PATCH] Match the local q DHX parameter against the peer's q As FFC/DH peer public key validation uses the peer's q value instead of checking against the local q, we must also check that these q values match when setting the peer's public key. Fixes CVE-2026-42770 Signed-off-by: Norbert Pocs Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 19:56:27 2026 (cherry picked from commit 29b9df160cc5f20ee3907cce0cb271b982846bce) --- providers/implementations/exchange/dh_exch.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/providers/implementations/exchange/dh_exch.c b/providers/implementations/exchange/dh_exch.c index 2d5dcadf27..72de9452fc 100644 --- a/providers/implementations/exchange/dh_exch.c +++ b/providers/implementations/exchange/dh_exch.c @@ -113,12 +113,15 @@ static int dh_init(void *vpdhctx, void *vdh, const OSSL_PARAM params[]) static int dh_match_params(DH *priv, DH *peer) { int ret; + int ignore_q = 1; FFC_PARAMS *dhparams_priv = ossl_dh_get0_params(priv); FFC_PARAMS *dhparams_peer = ossl_dh_get0_params(peer); + if (dhparams_priv != NULL && dhparams_priv->q != NULL) + ignore_q = 0; ret = dhparams_priv != NULL && dhparams_peer != NULL - && ossl_ffc_params_cmp(dhparams_priv, dhparams_peer, 1); + && ossl_ffc_params_cmp(dhparams_priv, dhparams_peer, ignore_q); if (!ret) ERR_raise(ERR_LIB_PROV, PROV_R_MISMATCHING_DOMAIN_PARAMETERS); return ret; -- 2.55.0