OpenSSL AES-128-CBC encryption with scatter-gather buffer overflow

https://bugs.dpdk.org/show_bug.cgi?id=1987

Bug ID: 1987
Summary: OpenSSL AES-128-CBC encryption with scatter-gather
buffer overflow
Product: DPDK
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: cryptodev
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Group: security

Report date: 2025-02-20
Reported by: Gowtham Suresh Kumar <[email protected]>

Subject: Security Vulnerability: Buffer Overflow in DPDK function process_openssl_encryption_update() for segmented in-place operations

Dear DPDK Security Team,

I would like to report a buffer overflow vulnerability in DPDK that occurs in AES-128-CBC Encryption with Scatter-Gather, Inplace configuration for a particular corner case. This issue leads to out-of-bounds writes, potentially overwriting sensitive information such as plaintext or ciphertext outside the allocated buffer.
Issue Description:

The vulnerability can be reproduced by modifying sgl_segs parameter in AES-128-CBC Encryption Scatter-Gather (Inplace) test case increasing the segment count from 3 to 128, in test_cryptodev_aes_test_vectors.h. When using small segment sizes (e.g., 4 bytes per segment), incorrect pointer handling results in OpenSSL writing ciphertext outside the expected buffer bounds.

Key Findings:
- Incorrect Pointer Updates: The dst pointer is updated incorrectly across consecutive EVP_EncryptUpdate() calls, even when OpenSSL buffers input instead of producing immediate ciphertext.
- Buffer Overflow in EVP_Final(): When OpenSSL finally encrypts the accumulated data, it writes beyond the allocated buffer, overwriting adjacent memory.
- Segment Size Dependency: The issue occurs for small segment sizes specifically when sizes of consecutive segments together is smaller than block size of the cipher

Root Cause Analysis:
- dst pointer is updated incorrectly even when OpenSSL does not generate output (outl = 0).
- Small segments cause OpenSSL to delay encryption, leading to misalignment in buffer usage.
- On final encryption (EVP_Final()), OpenSSL writes ciphertext at an incorrect memory location, causing a buffer overflow.

Impact & Security Concerns:
This issue presents a critical security risk, as it allows OpenSSL to:
- Write sensitive plaintext or ciphertext outside the allocated buffer, potentially exposing cryptographic data.
- Corrupt adjacent memory, leading to unpredictable behavior or crashes.
- Introduce vulnerabilities that could be exploited depending on the deployment context.

Proposed Fix:
- Modify process_openssl_encryption_update() to ensure dst pointer is updated only when valid ciphertext is produced.
- Introduce additional checks to prevent buffer overflows when segment sizes are small.
- Expand test cases to include non-block-aligned segment sizes to detect similar issues.

You are receiving this mail because:
You are the assignee for the bug.