diff --git a/meta-oniro-staging/recipes-support/nss/nss/CVE-2020-12403.patch b/meta-oniro-staging/recipes-support/nss/nss/CVE-2020-12403.patch deleted file mode 100644 index 3ed8faf5288ed49ef8c65b9f63ed59ef4e7b83da..0000000000000000000000000000000000000000 --- a/meta-oniro-staging/recipes-support/nss/nss/CVE-2020-12403.patch +++ /dev/null @@ -1,68 +0,0 @@ -From c6c2243be1a1359b4f22ffa51a90e84dc43b98d0 Mon Sep 17 00:00:00 2001 -From: Marta Rybczynska <marta.rybczynska@huawei.com> -Date: Wed, 3 Nov 2021 12:12:37 +0100 -Subject: [PATCH] nss: fix CVE-2020-12403 - -# HG changeset patch -# User Benjamin Beurdouche <bbeurdouche@mozilla.com> -# Date 1595031218 0 -# Node ID c25adfdfab34ddb08d3262aac3242e3399de1095 -# Parent f282556e6cc7715f5754aeaadda6f902590e7e38 -Bug 1636771 - Fix incorrect call to Chacha20Poly1305 by PKCS11. r=jcj,kjacobs,rrelyea - -Differential Revision: https://phabricator.services.mozilla.com/D74801 - -Upstream-Status: Backport - -CVE: CVE-2020-12403 - -Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> ---- - .../pk11_gtest/pk11_chacha20poly1305_unittest.cc | 11 +++++++++-- - nss/lib/freebl/chacha20poly1305.c | 2 +- - 2 files changed, 10 insertions(+), 3 deletions(-) - -diff --git a/nss/gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc b/nss/gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc -index 2663441..a461977 100644 ---- a/nss/gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc -+++ b/nss/gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc -@@ -44,7 +44,7 @@ class Pkcs11ChaCha20Poly1305Test - SECItem params = {siBuffer, reinterpret_cast<unsigned char*>(&aead_params), - sizeof(aead_params)}; - -- // Encrypt with bad parameters. -+ // Encrypt with bad parameters (TagLen is too long). - unsigned int encrypted_len = 0; - std::vector<uint8_t> encrypted(data_len + aead_params.ulTagLen); - aead_params.ulTagLen = 158072; -@@ -53,9 +53,16 @@ class Pkcs11ChaCha20Poly1305Test - &encrypted_len, encrypted.size(), data, data_len); - EXPECT_EQ(SECFailure, rv); - EXPECT_EQ(0U, encrypted_len); -- aead_params.ulTagLen = 16; -+ -+ // Encrypt with bad parameters (TagLen is too short). -+ aead_params.ulTagLen = 2; -+ rv = PK11_Encrypt(key.get(), kMech, ¶ms, encrypted.data(), -+ &encrypted_len, encrypted.size(), data, data_len); -+ EXPECT_EQ(SECFailure, rv); -+ EXPECT_EQ(0U, encrypted_len); - - // Encrypt. -+ aead_params.ulTagLen = 16; - rv = PK11_Encrypt(key.get(), kMech, ¶ms, encrypted.data(), - &encrypted_len, encrypted.size(), data, data_len); - -diff --git a/nss/lib/freebl/chacha20poly1305.c b/nss/lib/freebl/chacha20poly1305.c -index 4daba2a..9d94f59 100644 ---- a/nss/lib/freebl/chacha20poly1305.c -+++ b/nss/lib/freebl/chacha20poly1305.c -@@ -60,7 +60,7 @@ ChaCha20Poly1305_InitContext(ChaCha20Poly1305Context *ctx, - PORT_SetError(SEC_ERROR_BAD_KEY); - return SECFailure; - } -- if (tagLen == 0 || tagLen > 16) { -+ if (tagLen != 16) { - PORT_SetError(SEC_ERROR_INPUT_LEN); - return SECFailure; - } diff --git a/meta-oniro-staging/recipes-support/nss/nss/CVE-2020-12403_2.patch b/meta-oniro-staging/recipes-support/nss/nss/CVE-2020-12403_2.patch deleted file mode 100644 index 18b1e58bf5cdbd3b446b67e93c0b7d4614d567a0..0000000000000000000000000000000000000000 --- a/meta-oniro-staging/recipes-support/nss/nss/CVE-2020-12403_2.patch +++ /dev/null @@ -1,96 +0,0 @@ -From 930bc9c5b0f9e6ed8dc9f9cd237eede41591a64e Mon Sep 17 00:00:00 2001 -From: Marta Rybczynska <marta.rybczynska@huawei.com> -Date: Wed, 3 Nov 2021 12:21:44 +0100 -Subject: [PATCH] nss: followup CVE-2020-12403 - -# HG changeset patch -# User Benjamin Beurdouche <bbeurdouche@mozilla.com> -# Date 1595031194 0 -# Node ID f282556e6cc7715f5754aeaadda6f902590e7e38 -# Parent 89733253df83ef7fe8dd0d49f6370b857e93d325 -Bug 1636771 - Disable PKCS11 incremental mode for ChaCha20. r=kjacobs,rrelyea - -Depends on D74801 - -Differential Revision: https://phabricator.services.mozilla.com/D83994 - -Upstream-Status: Backport - -CVE: CVE-2020-12403 - -Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> ---- - .../pk11_gtest/pk11_cipherop_unittest.cc | 49 +++++++++++++++++++ - nss/lib/softoken/pkcs11c.c | 1 + - 2 files changed, 50 insertions(+) - -diff --git a/nss/gtests/pk11_gtest/pk11_cipherop_unittest.cc b/nss/gtests/pk11_gtest/pk11_cipherop_unittest.cc -index 38982fd..700750c 100644 ---- a/nss/gtests/pk11_gtest/pk11_cipherop_unittest.cc -+++ b/nss/gtests/pk11_gtest/pk11_cipherop_unittest.cc -@@ -77,4 +77,53 @@ TEST(Pkcs11CipherOp, SingleCtxMultipleUnalignedCipherOps) { - NSS_ShutdownContext(globalctx); - } - -+TEST(Pkcs11CipherOp, SingleCtxMultipleUnalignedCipherOpsChaCha20) { -+ PK11SlotInfo* slot; -+ PK11SymKey* key; -+ PK11Context* ctx; -+ -+ NSSInitContext* globalctx = -+ NSS_InitContext("", "", "", "", NULL, -+ NSS_INIT_READONLY | NSS_INIT_NOCERTDB | NSS_INIT_NOMODDB | -+ NSS_INIT_FORCEOPEN | NSS_INIT_NOROOTINIT); -+ -+ const CK_MECHANISM_TYPE cipher = CKM_NSS_CHACHA20_CTR; -+ -+ slot = PK11_GetInternalSlot(); -+ ASSERT_TRUE(slot); -+ -+ // Use arbitrary bytes for the ChaCha20 key and IV -+ uint8_t key_bytes[32]; -+ for (size_t i = 0; i < 32; i++) { -+ key_bytes[i] = i; -+ } -+ SECItem keyItem = {siBuffer, key_bytes, 32}; -+ -+ uint8_t iv_bytes[16]; -+ for (size_t i = 0; i < 16; i++) { -+ key_bytes[i] = i; -+ } -+ SECItem ivItem = {siBuffer, iv_bytes, 16}; -+ -+ SECItem* param = PK11_ParamFromIV(cipher, &ivItem); -+ -+ key = PK11_ImportSymKey(slot, cipher, PK11_OriginUnwrap, CKA_ENCRYPT, -+ &keyItem, NULL); -+ ctx = PK11_CreateContextBySymKey(cipher, CKA_ENCRYPT, key, param); -+ ASSERT_TRUE(key); -+ ASSERT_TRUE(ctx); -+ -+ uint8_t outbuf[128]; -+ // This is supposed to fail for Chacha20. This is because the underlying -+ // PK11_CipherOp operation is calling the C_EncryptUpdate function for -+ // which multi-part is disabled for ChaCha20 in counter mode. -+ ASSERT_EQ(GetBytes(ctx, outbuf, 7), SECFailure); -+ -+ PK11_FreeSymKey(key); -+ PK11_FreeSlot(slot); -+ SECITEM_FreeItem(param, PR_TRUE); -+ PK11_DestroyContext(ctx, PR_TRUE); -+ NSS_ShutdownContext(globalctx); -+} -+ - } // namespace nss_test -diff --git a/nss/lib/softoken/pkcs11c.c b/nss/lib/softoken/pkcs11c.c -index 6f3c2aa..53ec5f4 100644 ---- a/nss/lib/softoken/pkcs11c.c -+++ b/nss/lib/softoken/pkcs11c.c -@@ -1205,6 +1205,7 @@ sftk_CryptInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, - break; - - case CKM_NSS_CHACHA20_CTR: -+ context->multi = PR_FALSE; - if (key_type != CKK_NSS_CHACHA20) { - crv = CKR_KEY_TYPE_INCONSISTENT; - break; diff --git a/meta-oniro-staging/recipes-support/nss/nss_3.51.1.bbappend b/meta-oniro-staging/recipes-support/nss/nss_3.51.1.bbappend deleted file mode 100644 index 1d512e790f6f966172337d99c04882038b5c7317..0000000000000000000000000000000000000000 --- a/meta-oniro-staging/recipes-support/nss/nss_3.51.1.bbappend +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-FileCopyrightText: Huawei Inc. -# -# SPDX-License-Identifier: Apache-2.0 - -FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" -SRC_URI += "file://CVE-2020-12403.patch file://CVE-2020-12403_2.patch" -