CVE-2018-16150 (C, published 2018-11-07T20:29Z)
Description: value: In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509 certificates. This is a variant of CVE-2006-4340.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/igrr/axtls-8266
Files changed:
ssl/os_port.h
ssl/x509.c
Commit message: Apply CVE fixes for X509 parsing

Apply patches developed by Sze Yiu which correct a vulnerability in
X509 parsing.  See CVE-2018-16150 and CVE-2018-16149 for more info.


Vulnerable code:

/**
 * Retrieve the signature from a certificate.
 */
static const uint8_t *get_signature(const uint8_t *asn1_sig, int *len)
{
    int offset = 0;
    const uint8_t *ptr = NULL;

    if (asn1_next_obj(asn1_sig, &offset, ASN1_SEQUENCE) < 0 || 
            asn1_skip_obj(asn1_sig, &offset, ASN1_SEQUENCE))
        goto end_get_sig;

    if (asn1_sig[offset++] != ASN1_OCTET_STRING)
        goto end_get_sig;
    *len = get_asn1_length(asn1_sig, &offset);
    ptr = &asn1_sig[offset];          /* all ok */

end_get_sig:
    return ptr;
}

static bigint *sig_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len,
    int i, size;
    i = 10; /* start at the first possible non-padded byte */
    while (block[i++] && i < sig_len);
    size = sig_len - i;

    /* get only the bit we want */
    if (size > 0)
    {
        int len;
        const uint8_t *sig_ptr = get_signature(&block[i], &len);
        if (sig_ptr)
        {
            bir = bi_import(ctx, sig_ptr, len);
        }
    cert_sig = sig_verify(ctx, cert->signature, cert->sig_len, 

Fixed code:
static inline int memcmp_P(const void *a1, const void *b1, size_t len) {
    const uint8_t* a = (const uint8_t*)(a1);
    uint8_t* b = (uint8_t*)(b1);
    for (size_t i=0; i<len; i++) {
        uint8_t d = pgm_read_byte(a) - pgm_read_byte(b);
        if (d) return d;
        a++;
        b++;
    }
    return 0;
}

static const uint8_t sig_prefix_md5[] PROGMEM = {0x30, 0x20, 0x30, 0x0C, 0x06, 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10};
static const uint8_t sig_prefix_sha1[] PROGMEM = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0E, 0x03, 0x02, 0x1A, 0x05, 0x00, 0x04, 0x14};
static const uint8_t sig_prefix_sha256[] PROGMEM = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20};
static const uint8_t sig_prefix_sha384[] PROGMEM = {0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30};
static const uint8_t sig_prefix_sha512[] PROGMEM = {0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40};

static bigint *sig_verify(BI_CTX *ctx, const uint8_t *sig, int sig_len, uint8_t sig_type,
    int i;
    const uint8_t *sig_prefix = NULL;
    uint8_t sig_prefix_size = 0, hash_len = 0;
    /* adjust our expections */
    switch (sig_type)
    {
        case SIG_TYPE_MD5:
            sig_prefix = sig_prefix_md5;
            sig_prefix_size = sizeof(sig_prefix_md5);
        break;
        case SIG_TYPE_SHA1:
            sig_prefix = sig_prefix_sha1;
            sig_prefix_size = sizeof(sig_prefix_sha1);
        break;
        case SIG_TYPE_SHA256:
            sig_prefix = sig_prefix_sha256;
            sig_prefix_size = sizeof(sig_prefix_sha256);
        break;
        case SIG_TYPE_SHA384:
            sig_prefix = sig_prefix_sha384;
            sig_prefix_size = sizeof(sig_prefix_sha384);
        break;
        case SIG_TYPE_SHA512:
            sig_prefix = sig_prefix_sha512;
            sig_prefix_size = sizeof(sig_prefix_sha512);
        break;
    }
    if (sig_prefix)
        hash_len = sig_prefix[sig_prefix_size - 1];

    /* check length (#A) */
    if (sig_len < 2 + 8 + 1 + sig_prefix_size + hash_len)
        goto err;

    /* check the first 2 bytes */
    if (block[0] != 0 || block[1] != 1)
        goto err;
    /* check the padding */
    i = 2; /* start at the first padding byte */
    while (i < sig_len - 1 - sig_prefix_size - hash_len)
    { /* together with (#A), we require at least 8 bytes of padding */
        if (block[i++] != 0xFF)
            goto err;

    /* check end of padding */
    if (block[i++] != 0)
        goto err;

    /* check the ASN.1 metadata */
    if (memcmp_P(block+i, sig_prefix, sig_prefix_size))
        goto err;

    /* now we can get the hash we need */
    bir = bi_import(ctx, block + i + sig_prefix_size, hash_len);

err:
    cert_sig = sig_verify(ctx, cert->signature, cert->sig_len, cert->sig_type,