ASAN reports memory leak when used with GnuTLS in Knot

Aperta
  • Qualcosa non va?
#896 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Ambito
cryptography, security

Direzione di ricerca

Start by reproducing the leak with the reported keymgr -c knot.conf softhsm keystore-bench 1 ed25519 command and inspect the SoftHSM stack frames around OSSL::byteString2oid in src/lib/crypto/OSSLUtil.cpp:186. Compare the report across SoftHSM versions and trace allocations made during C_SignInit and signing through GnuTLS. Done means identifying whether SoftHSM retains allocated memory and fixing or documenting the cause.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

In Knot code, there is call of gnutls_privkey_sign_data2() function.. When used with libsofthsm2.so, ASAN reports memory leaks when running keymgr bench on algorithm ED25519 or ED448 like keymgr -c knot.conf softhsm keystore-bench 1 ed25519

https://gitlab.nic.cz/knot/knot-dns/-/blob/master/src/libknot/dnssec/sign/sign.c?ref_type=heads#L322

They differ based on SoftHSMv2 version.. Under main branch

Direct leak of 266232 byte(s) in 11093 object(s) allocated from:
    #0 0x5a5ce71c73a8 in malloc (/home/jhak/Work/knot-dns/build/sbin/keymgr+0x32a3a8) (BuildId: a66f3172de7f0daa2cc3c4584a8c1f9e1615d8c7)
    #1 0x7b08f0461d65 in CRYPTO_malloc (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x261d65) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #2 0x7b08f0461ef4 in CRYPTO_zalloc (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x261ef4) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #3 0x7b08f030d0b4 in ASN1_STRING_type_new (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x10d0b4) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #4 0x7b08f0317935  (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x117935) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #5 0x7b08f03183f2  (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1183f2) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #6 0x7b08f03187bd in ASN1_item_d2i_ex (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1187bd) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #7 0x7f0b92babfb6 in OSSL::byteString2oid(ByteString const&) /home/jhak/Work/SoftHSMv2/src/lib/crypto/OSSLUtil.cpp:186:40
    #8 0x7f0b92bfb96f in vtable for std::_Vector_base<unsigned char, SecureAllocator<unsigned char>>::_Vector_impl (/home/jhak/Work/SoftHSMv2/build/lib/softhsm/libsofthsm2.so+0xe396f) (BuildId: 9ff1854581b9c235aa7edc53c2d583000f2cac9b)

Indirect leak of 144209 byte(s) in 11093 object(s) allocated from:
    #0 0x5a5ce71c73a8 in malloc (/home/jhak/Work/knot-dns/build/sbin/keymgr+0x32a3a8) (BuildId: a66f3172de7f0daa2cc3c4584a8c1f9e1615d8c7)
    #1 0x7b08f0461d65 in CRYPTO_malloc (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x261d65) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #2 0x7b08f030cf28 in ASN1_STRING_set (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x10cf28) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #3 0x7b08f03177dd  (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1177dd) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #4 0x7b08f03183f2  (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1183f2) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #5 0x7b08f03187bd in ASN1_item_d2i_ex (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1187bd) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #6 0x7f0b92babfb6 in OSSL::byteString2oid(ByteString const&) /home/jhak/Work/SoftHSMv2/src/lib/crypto/OSSLUtil.cpp:186:40
    #7 0x7f0b92bfb96f in vtable for std::_Vector_base<unsigned char, SecureAllocator<unsigned char>>::_Vector_impl (/home/jhak/Work/SoftHSMv2/build/lib/softhsm/libsofthsm2.so+0xe396f) (BuildId: 9ff1854581b9c235aa7edc53c2d583000f2cac9b)

and under stable version SoftHSM v2.6.1, I get

Direct leak of 839184 byte(s) in 34966 object(s) allocated from:
    #0 0x62d7e56873a8 in malloc (/home/jhak/Work/knot-dns/build/sbin/keymgr+0x32a3a8) (BuildId: a66f3172de7f0daa2cc3c4584a8c1f9e1615d8c7)
    #1 0x6c1c2e661d65 in CRYPTO_malloc (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x261d65) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #2 0x6c1c2e661ef4 in CRYPTO_zalloc (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x261ef4) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #3 0x6c1c2e50d0b4 in ASN1_STRING_type_new (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x10d0b4) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #4 0x6c1c2e517935  (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x117935) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #5 0x6c1c2e5183f2  (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1183f2) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #6 0x6c1c2e5187bd in ASN1_item_d2i_ex (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1187bd) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #7 0x701ed0bae2bd  (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x942bd) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #8 0x701ed0ba2bed  (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x88bed) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #9 0x701ed0b6b8a9  (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x518a9) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #10 0x701ed0b72f86  (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x58f86) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #11 0x701ed0b426af in C_SignInit (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x286af) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #12 0x701ed1c8c56f  (/usr/lib/x86_64-linux-gnu/libgnutls.so.30+0x8c56f) (BuildId: 8fd502e8f1079f55b9aa0296c390f968c3b464cf)
    #13 0x701ed1c8e244 in gnutls_privkey_sign_data2 (/usr/lib/x86_64-linux-gnu/libgnutls.so.30+0x8e244) (BuildId: 8fd502e8f1079f55b9aa0296c390f968c3b464cf)
    #14 0x701ed229f948 in dnssec_sign_write /home/jhak/Work/knot-dns/src/libknot/dnssec/sign/sign.c:322:15
    #15 0x62d7e56f07e7 in bench /home/jhak/Work/knot-dns/src/utils/keymgr/keystore.c:291:7
    #16 0x62d7e58b96e9 in thread_ep /home/jhak/Work/knot-dns/src/knot/server/dthreads.c:137:4
    #17 0x62d7e5684c2a in asan_thread_start(void*) asan_interceptors.cpp.o
    #18 0x701ed193772b in __GI___clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Indirect leak of 454558 byte(s) in 34966 object(s) allocated from:
    #0 0x62d7e56873a8 in malloc (/home/jhak/Work/knot-dns/build/sbin/keymgr+0x32a3a8) (BuildId: a66f3172de7f0daa2cc3c4584a8c1f9e1615d8c7)
    #1 0x6c1c2e661d65 in CRYPTO_malloc (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x261d65) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #2 0x6c1c2e50cf28 in ASN1_STRING_set (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x10cf28) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #3 0x6c1c2e5177dd  (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1177dd) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #4 0x6c1c2e5183f2  (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1183f2) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #5 0x6c1c2e5187bd in ASN1_item_d2i_ex (/usr/lib/x86_64-linux-gnu/libcrypto.so.3+0x1187bd) (BuildId: ffa943c825cabf5254c51e779463b97dfdf510c1)
    #6 0x701ed0bae2bd  (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x942bd) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #7 0x701ed0ba2bed  (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x88bed) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #8 0x701ed0b6b8a9  (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x518a9) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #9 0x701ed0b72f86  (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x58f86) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #10 0x701ed0b426af in C_SignInit (/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so+0x286af) (BuildId: 1c3f1e7cc1022e5930f6c11d9474eea9262258b2)
    #11 0x701ed1c8c56f  (/usr/lib/x86_64-linux-gnu/libgnutls.so.30+0x8c56f) (BuildId: 8fd502e8f1079f55b9aa0296c390f968c3b464cf)
    #12 0x701ed1c8e244 in gnutls_privkey_sign_data2 (/usr/lib/x86_64-linux-gnu/libgnutls.so.30+0x8e244) (BuildId: 8fd502e8f1079f55b9aa0296c390f968c3b464cf)
    #13 0x701ed229f948 in dnssec_sign_write /home/jhak/Work/knot-dns/src/libknot/dnssec/sign/sign.c:322:15
    #14 0x62d7e56f07e7 in bench /home/jhak/Work/knot-dns/src/utils/keymgr/keystore.c:291:7
    #15 0x62d7e58b96e9 in thread_ep /home/jhak/Work/knot-dns/src/knot/server/dthreads.c:137:4
    #16 0x62d7e5684c2a in asan_thread_start(void*) asan_interceptors.cpp.o
    #17 0x701ed193772b in __GI___clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

I'm not really sure thats problem of GnuTLS, I would say thats SoftHSM bug. Can you take a look at it?

Lingua principale
C++
Stelle
1.1k
Fork
434
Merge medio
12g 14h
PR unite (30g)
2

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di softhsm/SoftHSMv2

Tutte le issue di softhsm/SoftHSMv2

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.