armv8 paca: poly1305 users see segfaults when pointer authentication in use on AWS Graviton 3 instances
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| openssl (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| Focal |
Fix Released
|
High
|
Matthew Ruffell | ||
Bug Description
[Impact]
Support for hardware pointer authentication for armv8 systems was merged in openssl 1.1.1f, but it contains a bug in the implementation for poly1305 message authenticated code routines, which causes the calling program to fail pointer authentication, which causes the program to crash with a segmentation fault.
You can easily test it by accessing any website that uses poly1305. There is no workaround except use a different MAC.
[Testcase]
This bug applies to armv8 systems which support pointer authentication. Start an armv8 instance, such as a c7g graviton 3 instance on AWS, and make sure the paca flag is present in lscpu:
$ grep paca /proc/cpuinfo
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 sm3 sm4 asimddp sha512 sve asimdfhm dit uscat ilrcpc flagm ssbs paca pacg dcpodp svei8mm svebf16 i8mm bf16 dgh rng
Next, attempt to connect to any website that uses poly1305 MAC.
$ curl https:/
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0Segmentation fault (core dumped)
There is a test package available in the following ppa:
https:/
Install it, and poly1305 operations will no longer segfault.
[Where problems could occur]
The patch changes the order of operations for loading the SP and checking the AUTIASP against it, from checking the AUTIASP against nothing then loading the correct SP to check with, to the correct loading the SP and then checking the AUTIASP against the SP.
This only changes one code path for armv8 systems, and other architectures are not affected. This is also only limited to poly1305 MAC.
If a regression were to occur, it would only affect users of poly1035 MAC on armv8 with pacs support.
[Other info]
The fix landed upstream in openssl 1.1.1i with the following commit:
commit 5795acffd8706e1
Author: Ard Biesheuvel <email address hidden>
Date: Tue Oct 27 18:02:40 2020 +0100
Subject: crypto/
Link: https:/
This commit is already present in Impish onward. Only Focal needs the fix.
| Changed in openssl (Ubuntu): | |
| status: | New → Fix Released |
| Changed in openssl (Ubuntu Focal): | |
| status: | New → In Progress |
| importance: | Undecided → High |
| assignee: | nobody → Matthew Ruffell (mruffell) |
| tags: | added: focal sts |
| Matthew Ruffell (mruffell) wrote | #1 |
| tags: | added: sts-sponsor |
| tags: | added: sts-sponsor-mfo |
| Mauricio Faria de Oliveira (mfo) wrote | #2 |
| Mauricio Faria de Oliveira (mfo) wrote | #3 |
| Seth Arnold (seth-arnold) wrote | #4 |
| Mauricio Faria de Oliveira (mfo) wrote | #5 |
| Robie Basak (racb) wrote Please test proposed package | #6 |
| Changed in openssl (Ubuntu Focal): | |
| status: | In Progress → Fix Committed |
| tags: | added: verification-needed verification-needed-focal |
| Robie Basak (racb) wrote | #7 |
| Ubuntu SRU Bot (ubuntu-sru-bot) wrote Autopkgtest regression report (openssl/1.1.1f-1ubuntu2.11) | #8 |
| Matthew Ruffell (mruffell) wrote | #9 |
| tags: |
added: verification-done verification-done-focal removed: sts-sponsor verification-needed verification-needed-focal |
| Łukasz Zemczak (sil2100) wrote Update Released | #10 |
| Launchpad Janitor (janitor) wrote | #11 |
| Changed in openssl (Ubuntu Focal): | |
| status: | Fix Committed → Fix Released |
Attached is a debdiff for openssl on Focal