bugGNU GRUB - Bugs: bug #66603, grub_crypto_memcmp side-channel

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #66603: grub_crypto_memcmp side-channel

Submitter:  Jonathan Bar Or ("JBO") <yo_yo_yo_jbo>
Submitted:  Fri 27 Dec 2024 04:22:41 PM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  other
Release:  Reproducibility:  None
Planned Release:  None

Fri 02 May 2025 01:49:02 PM UTC, comment #3: 

Hi Vladimir and others,

Checking in on this bug (#66603) as it relates to CVE-2024-56738, which is still affecting current Debian releases (tracked in Debian bug #1102217: https://bugs.debian.org/1102217) .

I see Vladimir Serbinenko mentioned back in December 2024 (comment #2) a plan to switch to using libgcrypt functions after updating libgcrypt. Has there been any progress on that front, or is there an estimated timeline?

In the meantime, the constant-time comparison fix proposed by Jonathan Bar Or in the original report (or a similar patch, like the one I have tested based on the same principle) seems like a viable solution to address the immediate side-channel vulnerability.

Would applying such a direct fix be acceptable for GRUB in the interim, or is the switch to libgcrypt the only path forward?

I have a tested patch implementing the constant-time comparison using bitwise operations (similar to the one attached here previously) that resolves the issue on Debian systems. Happy to provide it again if helpful.

Thanks,
Mostafa

Mostafa Amin <mosafaamin>
Fri 27 Dec 2024 07:39:00 PM UTC, comment #2: 

Thank you for reporting this. Will switch from this code to gcrypt code after we update libgcrypt

Vladimir Serbinenko <phcoder>
Group administrator
Fri 27 Dec 2024 04:46:18 PM UTC, comment #1: 

Might not be such a big deal since grub offers commands to read arbitrary files and memory, but this might still be an issue for some use cases.

Jonathan Bar Or ("JBO") <yo_yo_yo_jbo>
Fri 27 Dec 2024 04:22:41 PM UTC, original submission:  

The cryptographic comparison function "grub_crypto_memcmp" is susceptible to side-channel attack due to the "if" condition when comparing bytes:

if (*pa != *pb)
counter++;

The recommended way would be the following:

int
grub_crypto_memcmp (const void *a, const void *b, grub_size_t n)
{
  register grub_uint8_t indicator = 0;
  grub_uint8_t* pa = a, *b = b;
  grub_size_t i;
 
  for (i=0; i<n;i++)
    indicator |= (pa[i] ^ pb[i]);

  return !!indicator;
}

Jonathan Bar Or ("JBO") <yo_yo_yo_jbo>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mosafaamin (Posted a comment)
  • -email is unavailable- added by phcoder (Posted a comment)
  • -email is unavailable- added by yo_yo_yo_jbo (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.15-f813.
    Corresponding source code