A vulnerability (CVE-2022-37454) has been identified in the implementation of the SHA-3 (Keccak) cryptographic hash function offered in the XKCP (eXtended Keccak Code Package), which may lead to a buffer overflow during the processing of specifically formatted data. The issue is caused by a bug in the specific implementation of SHA-3, rather than a vulnerability in the algorithm itself. The XKCP package is presented as the official implementation of SHA-3, developed with the participation of the Keccak development team and used as a basis for SHA-3 functions in various programming languages (for example, the XKCP code is utilized in the Python module hashlib, Ruby package digest-sha3, and PHP functions hash_*).
According to the researcher who discovered the issue, they were able to exploit the vulnerability to break the cryptographic properties of the hash function, allowing the discovery of the first and second preimages, as well as identifying collisions. Furthermore, a prototype exploit has been created, which allows for code execution when hashing a specially formatted file. Potentially, the vulnerability could also be used to attack digital signature verification algorithms that utilize SHA-3 (for instance, Ed448). Details on the methods for conducting attacks are expected to be published later, after the vulnerability has been mitigated widely.
It is currently unclear how the vulnerability affects existing applications in practice, as the problem requires that the code involves cyclic hash computation in blocks, with one of the processed blocks needing to be around 4 GB in size (at least 2^32 — 200 bytes). When processing input data all at once (without sequential hash computation in parts), the issue does not arise. A simple protection method suggested is to limit the maximum size of data involved in a single iteration of hash computation.
The vulnerability is caused by an error in the block processing of input data. Due to incorrect comparison of values with the type 'int', an incorrect size of the data awaiting processing is determined, which leads to writing a tail beyond the allocated buffer. In particular, the expression 'partialBlock + instance->byteIOIndex' was used in the comparison, which led to integer overflow with large values of the components. Additionally, there was an incorrect type cast '(unsigned int)(dataByteLen - i)' in the code, causing overflow on systems with a 64-bit size_t type.
Example of code that causes overflow: import hashlib h = hashlib.sha3_224() m1 = b'\x00' * 1; m2 = b'\x00' * 4294967295; h.update(m1) h.update(m2) print(h.hexdigest())
Source: opennet.ru
