CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures

[Dennis Jackson <djackson () mozilla com>]

Summary:

NSS (Network Security Services) versions prior to 3.73 are vulnerable
to a heap overflow when handling DER-encoded DSA or RSA-PSS
signatures. Applications using NSS for handling signatures encoded
within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted.
Applications using NSS for certificate validation or other TLS, X.509,
OCSP or CRL functionality may be impacted, depending on how they
configure NSS.

This vulnerability does NOT impact Mozilla Firefox, Tor Browser or
Chromium. However, other applications that use NSS for signature
verification are likely to be impacted.

Technical Details:

When verifying a DER-encoded signature, NSS decodes the signature into
a fixed-size buffer and passes the buffer to the underlying PKCS #11
module. The length of the signature is not correctly checked when
processing DSA and RSA-PSS signatures. DSA and RSA-PSS signatures
larger than 16384 bits will overflow the buffer in VFYContextStr. The
vulnerable code is located within secvfy.c:vfy_CreateContext.

Test cases are attached (tests.zip) and can be tested using the
vfychain tool shipped with NSS. Running `vfychain -a {input.cert}`
will cause a segfault on vulnerable versions and a failed verification
on fixed versions.

Remediation:

NSS 3.73 [1] and NSS ESR 3.68.1 [2] have been released and contain the
fix. A patch suitable for backporting is also attached (patch.diff).

Acknowledgements:

This vulnerability was reported to the NSS team by Tavis Ormandy of
Project Zero.

Links:

Advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
[1] https://hg.mozilla.org/projects/nss/shortlog/NSS_3_73_BRANCH
[2] https://hg.mozilla.org/projects/nss/shortlog/NSS_3_68_1_BRANCH

--

Kind regards,
Dennis Jackson
On behalf of the NSS Team at Mozilla

Attachment: tests.zip
Description:

Attachment: patch.diff
Description: