CVE-2012-6085: Input Validation
KB Sriram (kbsriram) reports:
Versions of GnuPG <= 1.4.12 are vulnerable to memory access violations and public keyring database corruption when importing public keys that have been manipulated.
An OpenPGP key can be fuzzed in such a way that gpg segfaults (or has other memory access violations) when importing the key.
The key may also be fuzzed such that gpg reports no errors when examining the key (eg: "gpg thebadkey.pkr") but importing it causes gpg to corrupt its public keyring database.
The database corruption issue was first reported on Dec 6th, through the gpg bug tracking system:
https://bugs.g10code.com/gnupg/issue1455
The subsequent memory access violation was discovered and reported in a private email with the maintainer on Dec 20th.
A zip file with keys that causes segfaults and other errors is available at http://dl.dropbox.com/u/18852638/gnupg-issues/1455.zip and includes a log file that demonstrates the issues [on MacOS X and gpg 1.4.11]
A new version of gpg -- 1.4.13 -- that addressed both these issues, was independently released by the maintainer on Dec 20th.
The simplest solution is to upgrade all gpg installs to 1.4.13.
[Workarounds: A corrupted database may be recovered by manually copying back the pubring.gpg~ backup file. Certain errors may also be prevented by never directly importing a key, but first just "looking" at the key (eg: "gpg badkey.pkr"). However, this is not guaranteed to work in all cases; though upgrading to 1.4.13 does work for the issues reported.]
Discovery:
The problem was discovered during a byte-fuzzing test of OpenPGP certificates for an unrelated application. Each byte in turn was replaced by a random byte, and the modified certificate fed to the application to check that it handled errors correctly. Gpg was used as a control, but it itself turned out to have errors related to packet parsing. The errors are generally triggered when fuzzing the length field of OpenPGP packets, which cascades into subsequent errors in certain situations.
External references: https://bugs.g10code.com/gnupg/issue1455 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=f0b33b6fb8e0586e9584a7a409dcc31263776a67
Other sources
The readblock function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6085?
CVE-2012-6085 has a medium severity due to memory access violations and potential database corruption.
How do I fix CVE-2012-6085?
To fix CVE-2012-6085, upgrade GnuPG to version 1.4.13 or later.
What versions of GnuPG are affected by CVE-2012-6085?
Versions of GnuPG up to and including 1.4.12 are affected by CVE-2012-6085.
What are the consequences of CVE-2012-6085?
Exploitation of CVE-2012-6085 can lead to application crashes and corruption of the public keyring database.
Is CVE-2012-6085 still relevant?
Although CVE-2012-6085 was identified over a decade ago, it remains important for users running vulnerable versions of GnuPG.