From d1613e2e849557de7f9fc34257ae7b5c520fb59f Mon Sep 17 00:00:00 2001 From: Daniel Kubec Date: Tue, 21 Jul 2026 11:19:29 +0200 Subject: [PATCH] Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg ossl_cmp_calc_protection() only checked whether the protectionAlg parameter (ppval) was NULL before treating it as a PBMParameter ASN1_STRING. X509_ALGOR_get0() does not validate the ASN.1 type of the parameter against what the caller expects. For id-PasswordBasedMAC, a crafted message can encode the parameter as a BOOLEAN instead of the expected PBMParameter SEQUENCE. Because the ASN1_TYPE value union overlays the boolean int on the pointer field, ppval comes back as a bogus non-NULL pointer (e.g. 0xff). Fixes CVE-2026-63076 Reviewed-by: Milan Broz Reviewed-by: Norbert Pocs Merge-date: Sat Aug 22 06:12:04 2026 --- crypto/cmp/cmp_protect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/cmp/cmp_protect.c b/crypto/cmp/cmp_protect.c index e9c4d52485..d45f0da029 100644 --- a/crypto/cmp/cmp_protect.c +++ b/crypto/cmp/cmp_protect.c @@ -66,7 +66,7 @@ ASN1_BIT_STRING *ossl_cmp_calc_protection(const OSSL_CMP_CTX *ctx, ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET); return NULL; } - if (ppval == NULL) { + if (pptype != V_ASN1_SEQUENCE || ppval == NULL) { ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION); return NULL; } -- 2.55.0