CVE-2022-24884 (published 2022-05-06T00:15Z)

ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: `ecdsa_verify_list_legacy()` will accept an arbitrary number of such forged signatures. Both the `ecdsautil verify` CLI command and the libecdsautil library are affected. The issue has been fixed in ecdsautils 0.4.1. All older versions of ecdsautils (including versions before the split into a library and a CLI utility) are vulnerable.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/freifunk-gluon/ecdsautils
commit_details: repo_url: https://github.com/freifunk-gluon/ecdsautils
author: Matthias Schiffer
author_date: 2022-04-20 22:04:07+02:00
msg: verify: fix signature verification (CVE-2022-24884)

Verify that r and s are non-zero. Without these checks, an all-zero
signature is always considered valid.

While it would be nicer to error out in ecdsa_verify_prepare_legacy()
already, that would require users of libecdsautil to check a return value
of the prepare step. To be safe, implement the fix in an API/ABI-compatible
way that doesn't need changes to the users.
repository: repo_url: https://github.com/freifunk-gluon/ecdsautils
repo_name: freifunk-gluon/ecdsautils
description: Tiny collection of programs used for ECDSA (keygen, sign, verify)
repo_language: C
owner: freifunk-gluon
file_changes: filename: ecdsa.c
change_type: ModificationType.MODIFY
diff: @@ -135,6 +135,12 @@ regenerate:
 void ecdsa_verify_prepare_legacy(ecdsa_verify_context_t *ctx, const ecc_int256_t *hash, const ecdsa_signature_t *signature) {
   ecc_int256_t w, u1, tmp;
 
+  if (ecc_25519_gf_is_zero(&signature->s) || ecc_25519_gf_is_zero(&signature->r)) {
+    // Signature is invalid, mark by setting ctx->r to an invalid value
+    memset(&ctx->r, 0, sizeof(ctx->r));
+    return;
+  }
+
   ctx->r = signature->r;
 
   ecc_25519_gf_recip(&w, &signature->s);
@@ -149,6 +155,10 @@ bool ecdsa_verify_legacy(const ecdsa_verify_context_t *ctx, const ecc_25519_work
   ecc_25519_work_t s2, work;
   ecc_int256_t w, tmp;
 
+  // Signature was detected as invalid in prepare step
+  if (ecc_25519_gf_is_zero(&ctx->r))
+    return false;
+
   ecc_25519_scalarmult(&s2, &ctx->u2, pubkey);
   ecc_25519_add(&work, &ctx->s1, &s2);
   ecc_25519_store_xy_legacy(&w, NULL, &work);

programming_language: C
repo_url: https://github.com/freifunk-gluon/ecdsautils
commit_details: repo_url: https://github.com/freifunk-gluon/ecdsautils
author: Matthias Schiffer
author_date: 2022-05-05 18:01:14+02:00
msg: Merge pull request from GHSA-qhcg-9ffp-78pw

verify: fix signature verification (CVE-2022-24884)
repository: repo_url: https://github.com/freifunk-gluon/ecdsautils
repo_name: freifunk-gluon/ecdsautils
description: Tiny collection of programs used for ECDSA (keygen, sign, verify)
repo_language: C
owner: freifunk-gluon