CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures

[Benjamin Beurdouche]

Dear all,

We just released NSS 3.73 and NSS 3.68.1(ESR).

Those versions contain the fix for CVE-2021-43527 which affected previous versions.

The release notes for those versions of NSS will follow on this list shortly.

Best,

Benjamin

https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/

CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures

Summary:

NSS (Network Security Services) versions prior to 3.73 are vulnerable
to a heap overflow when handling DER-encoded DSA or RSA-PSS
signatures. Applications using NSS for handling signatures encoded
within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted.
Applications using NSS for certificate validation or other TLS, X.509,
OCSP or CRL functionality may be impacted, depending on how they
configure NSS.

This vulnerability does NOT impact Mozilla Firefox, Tor Browser or
Chromium. However, other applications that use NSS for signature
verification are likely to be impacted.

Technical Details:

When verifying a DER-encoded signature, NSS decodes the signature into
a fixed-size buffer and passes the buffer to the underlying PKCS #11
module. The length of the signature is not correctly checked when
processing DSA and RSA-PSS signatures. DSA and RSA-PSS signatures
larger than 16384 bits will overflow the buffer in VFYContextStr. The
vulnerable code is located within secvfy.c:vfy_CreateContext.

Test cases are attached (tests.zip) and can be tested using the
vfychain tool shipped with NSS. Running `vfychain -a {input.cert}`
will cause a segfault on vulnerable versions and a failed verification
on fixed versions.

Remediation:

NSS 3.73 [1] and NSS ESR 3.68.1 [2] have been released and contain the
fix. A patch suitable for backporting is also attached (patch.diff).

Acknowledgements:

This vulnerability was reported to the NSS team by Tavis Ormandy of
Project Zero.

Thanks to all the the NSS team members in all companies and the

Security Engineering team for its precious help in the fix and disclosure of this issue.