Clear form field entries in free_auth_form()

This covers more of the CVE-2018-20319 "passwords found in memory" issue.

Reported-by: Tom Wilson <twilson@nettitude.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

diff --git a/auth-common.c b/auth-common.c
index f44faa66af4c936aa656763e7da745a0b53e8c01..b0bdd9bd093960a3eae7ce5808b6710d1c2f2abb 100644 (file)
--- a/auth-common.c
+++ b/auth-common.c
@@ -109,12 +109,36 @@ int append_form_opts(struct openconnect_info *vpninfo,
        return 0;
 }
 
+void free_pass(char **p)
+{
+       if (!*p)
+               return;
+
+#if defined(HAVE_MEMSET_S)
+       memset_s(*p, 0x5a, strlen(*p));
+#elif defined(HAVE_EXPLICIT_MEMSET)
+       explicit_memset(*p, 0x5a, strlen(*p));
+#elif defined(HAVE_EXPLICIT_BZERO)
+       explicit_bzero(*p, strlen(*p));
+#elif defined(_WIN32)
+       SecureZeroMemory(*p, strlen(*p));
+#else
+       {
+               volatile char *pp = (volatile char *)*p;
+               while (*pp)
+                       *(pp++) = 0x5a;
+       }
+#endif
+       free(*p);
+       *p = NULL;
+}
+
 void free_opt(struct oc_form_opt *opt)
 {
        /* for SELECT options, opt->value is a pointer to oc_choice->name */
-       if (opt->type != OC_FORM_OPT_SELECT)
-               free(opt->_value);
-       else {
+       if (opt->type != OC_FORM_OPT_SELECT) {
+               free_pass(&opt->_value);
+       } else {
                struct oc_form_opt_select *sel = (void *)opt;
                int i;
 

diff --git a/configure.ac b/configure.ac
index 5065a298d17dcae493d8279df104ca13e72bbba9..b593e9af666a5c47ff545675cd68713a05258fe3 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -118,6 +118,16 @@ fi
 AC_DEFINE_UNQUOTED(DEFAULT_VPNCSCRIPT, "${with_vpnc_script}", [Default vpnc-script locatin])
 AC_SUBST(DEFAULT_VPNCSCRIPT, "${with_vpnc_script}")
 
+AC_CHECK_FUNC(memset_s,
+             [AC_DEFINE(HAVE_MEMSET_S, 1, [Have memset_s() function])],
+             [AC_CHECK_FUNC(explicit_memset,
+                           [AC_DEFINE(HAVE_EXPLICIT_MEMSET, 1, [Have explicit_memset() function])],
+                           [AC_CHECK_FUNC(explicit_bzero,
+                                          [AC_DEFINE(HAVE_EXPLICIT_BZERO, 1, [Have explicit_bzero() function])],
+                                          [])
+                           ])
+             ])
+
 AC_CHECK_FUNC(fdevname_r, [AC_DEFINE(HAVE_FDEVNAME_R, 1, [Have fdevname_r() function])], [])
 AC_CHECK_FUNC(statfs, [AC_DEFINE(HAVE_STATFS, 1, [Have statfs() function])], [])
 AC_CHECK_FUNC(getline, [AC_DEFINE(HAVE_GETLINE, 1, [Have getline() function])],

diff --git a/gnutls_tpm2_ibm.c b/gnutls_tpm2_ibm.c
index cc3e9d7224108a001d72c5a279d4611432cea09f..1077c694cf7581f71650c4ece76bea7a94eb7a90 100644 (file)
--- a/gnutls_tpm2_ibm.c
+++ b/gnutls_tpm2_ibm.c
@@ -44,15 +44,6 @@ struct oc_tpm2_ctx {
        unsigned int parent;
 };
 
-static void free_pass(char **p)
-{
-       if (!*p)
-               return;
-
-       memset(*p, 0x5a, strlen(*p));
-       free(*p);
-}
-
 static void tpm2_error(struct openconnect_info *vpninfo, TPM_RC rc, const char *reason)
 {
        const char *msg = NULL, *submsg = NULL, *num = NULL;

diff --git a/openconnect-internal.h b/openconnect-internal.h
index 8aa8fc89907d39eb7d59e53112fc5056d844533f..ecaaba1c30d6122f36743ab64f2ba2c2fec24895 100644 (file)
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -1013,6 +1013,7 @@ int xmlnode_match_prop(xmlNode *xml_node, const char *name, const char *match);
 int append_opt(struct oc_text_buf *body, const char *opt, const char *name);
 int append_form_opts(struct openconnect_info *vpninfo,
                     struct oc_auth_form *form, struct oc_text_buf *body);
+void free_pass(char **p);
 void free_opt(struct oc_form_opt *opt);
 void free_auth_form(struct oc_auth_form *form);
 int do_gen_tokencode(struct openconnect_info *vpninfo,

diff --git a/www/changelog.xml b/www/changelog.xml
index 315d9172409dafdc844ba5ac40266dabbbf4f377..b4218c106524a102d0a2236f07e9d4251e1c0086 100644 (file)
--- a/www/changelog.xml
+++ b/www/changelog.xml
@@ -15,6 +15,7 @@
 <ul>
    <li><b>OpenConnect HEAD</b>
      <ul>
+       <li>Clear form submissions (which may include passwords) before freeing (CVE-2018-20319).</li>
        <li>Allow form responses to be provided on command line.</li>
        <li>Add support for SSL keys stored in <a href="tpm.html">TPM2</a>.</li>
        <li>Fix ESP rekey when replay protection is disabled.</li>