Skip to content

X509_check_issued doesn't grab locks #6121

New issue
New issue
Closed
Closed
X509_check_issued doesn't grab locks#6121
Milestone
1.1.1
@mingtaoy

Description

@mingtaoy
mingtaoy
opened on Apr 27, 2018

I noticed that X509_check_issued calls x509v3_cache_extensions without acquiring locks on the individual X509 objects.

openssl/crypto/x509v3/v3_purp.c

Lines 758 to 764 in 272c0df

int X509_check_issued(X509 *issuer, X509 *subject)
{
if (X509_NAME_cmp(X509_get_subject_name(issuer),
X509_get_issuer_name(subject)))
return X509_V_ERR_SUBJECT_ISSUER_MISMATCH;
x509v3_cache_extensions(issuer);
x509v3_cache_extensions(subject);

It seems that x509v3_cache_extensions mutates fields like ex_flags. Other usages of x509v3_cache_extensions (in X509_check_purpose, X509_check_ca) acquire the lock before calling.

openssl/crypto/x509v3/v3_purp.c

Lines 77 to 84 in 272c0df

int X509_check_purpose(X509 *x, int id, int ca)
{
int idx;
const X509_PURPOSE *pt;
if (!(x->ex_flags & EXFLAG_SET)) {
CRYPTO_THREAD_write_lock(x->lock);
x509v3_cache_extensions(x);
CRYPTO_THREAD_unlock(x->lock);

openssl/crypto/x509v3/v3_purp.c

Lines 543 to 548 in 272c0df

int X509_check_ca(X509 *x)
{
if (!(x->ex_flags & EXFLAG_SET)) {
CRYPTO_THREAD_write_lock(x->lock);
x509v3_cache_extensions(x);
CRYPTO_THREAD_unlock(x->lock);

Given that X509_check_issued is an exported function, is there a possibility of a race here?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions