A SHA-3 (Keccak) cryptographic hash function implementation, proposed in the XKCP (eXtended Keccak Code Package), has revealed a vulnerability (CVE-2022-37454) that may lead to a buffer overflow when processing specifically formatted data. The problem is caused by a bug in the specific implementation of SHA-3, not a vulnerability in the algorithm itself. The XKCP package is presented as the official implementation of SHA-3, developed with the participation of the Keccak development team, and is used as the foundation in functions for working with SHA-3 in various programming languages (for example, the XKCP code is used in the Python hashlib module, the Ruby digest-sha3 package, and PHP hash_* functions).
According to the researcher who identified the problem, they were able to exploit the vulnerability to break the cryptographic properties of the hash function and find first and second pre-images, as well as define collisions. Additionally, a prototype exploit has reportedly been created that allows code execution when hashing a specially crafted file. The vulnerability may also potentially be used for attacks on digital signature verification algorithms that utilize SHA-3 (for example, Ed448). Details of the attack methods are planned to be published later, after the vulnerability is addressed worldwide.
It is unclear how the vulnerability affects existing applications in practice, as the problem in the code must involve cyclic hashing of blocks, with one of the processed blocks being about 4 GB in size (at least 2^32 — 200 bytes). When processing input data all at once (without sequentially hashing in parts), the problem does not manifest. The simplest protection method proposed is to limit the maximum size of data participating in a single iteration of the hash computation.
A sebezhetőség egy hiba miatt áll elő a bemeneti adatok blokk alapú feldolgozása során. Rossz típusú, "int" típusú értékek összehasonlítása miatt az elvárt feldolgozandó adatok mérete hamisan van meghatározva, ami a buffer túlcsordulásához vezet. Különösen a "partialBlock + instance->byteIOIndex" kifejezés hasonlítása vezetett egész számú túlcsorduláshoz nagy összetevőértékek esetén. Ezenkívül a kódban helytelen típuskonverzió volt, "(unsigned int)(dataByteLen — i)", ami szintén túlcsordulást okozott 64 bites size_t típussal rendelkező rendszereken.
Túlcsordulást okozó kód példa: import hashlib h = hashlib.sha3_224() m1 = b"\x00" * 1; m2 = b"\x00" * 4294967295; h.update(m1) h.update(m2) print(h.hexdigest())
Forrás: opennet.ru
