packages/gnupg2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CVE-2025-30258

Browse Source
This commit is contained in:
yixiangzhike 2025-05-06 15:50:10 +08:00
parent fcb2cb1965
commit cf184233d5
7 changed files with 1180 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

143
backport-0001-CVE-2025-30258-gpg-Lookup-key-for-merging-inserting-only-by-primary.patch Normal file
View File

@ -0,0 +1,143 @@
From deeaac89f55ef6a4dc1e859b0fb0f4e4ed6e86cd Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Tue, 11 Feb 2025 14:44:23 +0100
Subject: [PATCH 1/4] gpg: Lookup key for merging/inserting only by primary
key.
* g10/getkey.c (get_keyblock_byfpr_fast): Add arg primary_only and
implement.
* g10/import.c (import_one_real): Simplify filling the fpr buffer with
zeroes.
(import_one_real): Find key only by primary fingerprint.
--
This should have been done early: When looking up the original
keyblock we want to update, we need to lookup it up only using the
primary key. This avoids to find a key which has the primary key also
has a subkey.
GnuPG-bug-id: 7527
(ported by dkg from commit 25d748c3dfc0102f9e54afea59ff26b3969bd8c1
from STABLE-BRANCH-2-4)
Reference link:
https://salsa.debian.org/debian/gnupg2/-/blob/debian/2.2.46-6/debian/patches/from-2.4/gpg-Lookup-key-for-merging-inserting-only-by-primary-key.patch
Signed-off-by: baogen shang <baogen.shang@windriver.com>
---
g10/getkey.c | 23 ++++++++++++++++++++---
g10/import.c | 6 +++---
g10/keydb.h | 1 +
3 files changed, 24 insertions(+), 6 deletions(-)
diff --git a/g10/getkey.c b/g10/getkey.c
index 4642174..4747176 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -1970,7 +1970,7 @@ get_pubkey_byfprint_fast (PKT_public_key * pk,
gpg_error_t err;
KBNODE keyblock;
- err = get_keyblock_byfprint_fast (&keyblock, NULL, fprint, fprint_len, 0);
+ err = get_keyblock_byfprint_fast (&keyblock, NULL, 0, fprint, fprint_len, 0);
if (!err)
{
if (pk)
@@ -1987,10 +1987,13 @@ get_pubkey_byfprint_fast (PKT_public_key * pk,
* R_HD may be NULL. If LOCK is set the handle has been opend in
* locked mode and keydb_disable_caching () has been called. On error
* R_KEYBLOCK is set to NULL but R_HD must be released by the caller;
- * it may have a value of NULL, though. This allows to do an insert
- * operation on a locked keydb handle. */
+ * it may have a value of NULL, though. This allows one to do an insert
+ * operation on a locked keydb handle. If PRIMARY_ONLY is set
+ * the function returns a keyblock which has the requested fingerprint
+ * has primary key.*/
gpg_error_t
get_keyblock_byfprint_fast (kbnode_t *r_keyblock, KEYDB_HANDLE *r_hd,
+ int primary_only,
const byte *fprint, size_t fprint_len, int lock)
{
gpg_error_t err;
@@ -1998,6 +2001,8 @@ get_keyblock_byfprint_fast (kbnode_t *r_keyblock, KEYDB_HANDLE *r_hd,
kbnode_t keyblock;
byte fprbuf[MAX_FINGERPRINT_LEN];
int i;
+ byte tmpfpr[MAX_FINGERPRINT_LEN];
+ size_t tmpfprlen;
if (r_keyblock)
*r_keyblock = NULL;
@@ -2031,6 +2036,7 @@ get_keyblock_byfprint_fast (kbnode_t *r_keyblock, KEYDB_HANDLE *r_hd,
if (r_hd)
*r_hd = hd;
+ again:
err = keydb_search_fpr (hd, fprbuf);
if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
{
@@ -2050,6 +2056,17 @@ get_keyblock_byfprint_fast (kbnode_t *r_keyblock, KEYDB_HANDLE *r_hd,
log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
|| keyblock->pkt->pkttype == PKT_PUBLIC_SUBKEY);
+ if (primary_only)
+ {
+ fingerprint_from_pk (keyblock->pkt->pkt.public_key, tmpfpr, &tmpfprlen);
+ if (fprint_len != tmpfprlen || memcmp (fprint, tmpfpr, fprint_len))
+ {
+ release_kbnode (keyblock);
+ keyblock = NULL;
+ goto again;
+ }
+ }
+
/* Not caching key here since it won't have all of the fields
properly set. */
diff --git a/g10/import.c b/g10/import.c
index 0ce702e..b2a1462 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1859,7 +1859,6 @@ import_one_real (ctrl_t ctrl,
int mod_key = 0;
int same_key = 0;
int non_self = 0;
- size_t an;
char pkstrbuf[PUBKEY_STRING_SIZE];
int merge_keys_done = 0;
KEYDB_HANDLE hd = NULL;
@@ -1879,8 +1878,8 @@ import_one_real (ctrl_t ctrl,
pk = node->pkt->pkt.public_key;
fingerprint_from_pk (pk, fpr2, &fpr2len);
- for (an = fpr2len; an < MAX_FINGERPRINT_LEN; an++)
- fpr2[an] = 0;
+ if (MAX_FINGERPRINT_LEN > fpr2len)
+ memset (fpr2+fpr2len, 0, MAX_FINGERPRINT_LEN - fpr2len);
keyid_from_pk( pk, keyid );
uidnode = find_next_kbnode( keyblock, PKT_USER_ID );
@@ -2028,6 +2027,7 @@ import_one_real (ctrl_t ctrl,
/* Do we have this key already in one of our pubrings ? */
err = get_keyblock_byfprint_fast (&keyblock_orig, &hd,
+ 1 /*primary only */,
fpr2, fpr2len, 1/*locked*/);
if ((err
&& gpg_err_code (err) != GPG_ERR_NO_PUBKEY
diff --git a/g10/keydb.h b/g10/keydb.h
index 0f8d711..7457479 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -403,6 +403,7 @@ gpg_error_t get_pubkey_byfprint_fast (PKT_public_key *pk,
the user ids. */
gpg_error_t get_keyblock_byfprint_fast (kbnode_t *r_keyblock,
KEYDB_HANDLE *r_hd,
+ int primary_only,
const byte *fprint, size_t fprint_len,
int lock);
--
2.33.0

116
backport-0002-CVE-2025-30258-gpg-Remove-a-signature-check-function-wrapper.patch Normal file
View File

@ -0,0 +1,116 @@
From b54b7f5934b23dac80220f2c34e54fd6c71e689c Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Thu, 20 Feb 2025 14:50:20 +0100
Subject: [PATCH 2/4] gpg: Remove a signature check function wrapper.
* g10/sig-check.c (check_signature2): Rename to
(check_signature): this and remove the old wrapper. Adjust all
callers.
(cherry picked by dkg from commit 9cd371b12d80cfc5bc85cb6e5f5eebb4decbe94f)
Reference link:
https://salsa.debian.org/debian/gnupg2/-/blob/debian/2.2.46-6/debian/patches/from-2.4/gpg-Remove-a-signature-check-function-wrapper.patch
Signed-off-by: baogen shang <baogen.shang@windriver.com>
---
g10/mainproc.c | 5 ++---
g10/packet.h | 6 +-----
g10/sig-check.c | 15 +++------------
3 files changed, 6 insertions(+), 20 deletions(-)
diff --git a/g10/mainproc.c b/g10/mainproc.c
index d1c980b..8e788c3 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -1167,7 +1167,7 @@ do_check_sig (CTX c, kbnode_t node,
/* We only get here if we are checking the signature of a binary
(0x00) or text document (0x01). */
- rc = check_signature2 (c->ctrl, sig, md,
+ rc = check_signature (c->ctrl, sig, md,
forced_pk,
NULL, is_expkey, is_revkey, r_pk);
if (! rc)
@@ -1176,7 +1176,7 @@ do_check_sig (CTX c, kbnode_t node,
{
PKT_public_key *pk2;
- rc = check_signature2 (c->ctrl, sig, md2,
+ rc = check_signature (c->ctrl, sig, md2,
forced_pk,
NULL, is_expkey, is_revkey,
r_pk? &pk2 : NULL);
@@ -1837,7 +1837,6 @@ issuer_fpr_string (PKT_signature *sig)
return p? bin2hex (p, n, NULL) : NULL;
}
-
static void
print_good_bad_signature (int statno, const char *keyid_str, kbnode_t un,
PKT_signature *sig, int rc)
diff --git a/g10/packet.h b/g10/packet.h
index 187fffc..c40401a 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -882,16 +882,12 @@ int cmp_user_ids( PKT_user_id *a, PKT_user_id *b );
/*-- sig-check.c --*/
-/* Check a signature. This is shorthand for check_signature2 with
- the unnamed arguments passed as NULL. */
-int check_signature (ctrl_t ctrl, PKT_signature *sig, gcry_md_hd_t digest);
-
/* Check a signature. Looks up the public key from the key db. (If
* R_PK is not NULL, it is stored at RET_PK.) DIGEST contains a
* valid hash context that already includes the signed data. This
* function adds the relevant meta-data to the hash before finalizing
* it and verifying the signature. FOCRED_PK is usually NULL. */
-gpg_error_t check_signature2 (ctrl_t ctrl,
+gpg_error_t check_signature (ctrl_t ctrl,
PKT_signature *sig, gcry_md_hd_t digest,
PKT_public_key *forced_pk,
u32 *r_expiredate, int *r_expired, int *r_revoked,
diff --git a/g10/sig-check.c b/g10/sig-check.c
index afaa90a..a29470f 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -63,16 +63,6 @@ sig_check_dump_stats (void)
cache_stats.goodsig, cache_stats.badsig);
}
-
-/* Check a signature. This is shorthand for check_signature2 with
- the unnamed arguments passed as NULL. */
-int
-check_signature (ctrl_t ctrl, PKT_signature *sig, gcry_md_hd_t digest)
-{
- return check_signature2 (ctrl, sig, digest, NULL, NULL, NULL, NULL, NULL);
-}
-
-
/* Check a signature.
*
* Looks up the public key that created the signature (SIG->KEYID)
@@ -114,7 +104,7 @@ check_signature (ctrl_t ctrl, PKT_signature *sig, gcry_md_hd_t digest)
*
* Returns 0 on success. An error code otherwise. */
gpg_error_t
-check_signature2 (ctrl_t ctrl,
+check_signature (ctrl_t ctrl,
PKT_signature *sig, gcry_md_hd_t digest,
PKT_public_key *forced_pk,
u32 *r_expiredate,
@@ -721,7 +711,8 @@ check_revocation_keys (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig)
hash_public_key(md,pk);
/* Note: check_signature only checks that the signature
is good. It does not fail if the key is revoked. */
- rc = check_signature (ctrl, sig, md);
+ rc = check_signature (ctrl, sig, md, NULL, 0, NULL,
+ NULL, NULL, NULL, NULL);
cache_sig_result(sig,rc);
gcry_md_close (md);
break;
--
2.33.0

627
backport-0003-CVE-2025-30258-gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey.patch Normal file
View File

@ -0,0 +1,627 @@
From 702844978d82e375f6d71b72134bc567b9c5a35f Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Fri, 21 Feb 2025 12:16:17 +0100
Subject: [PATCH 3/4] gpg: Fix a verification DoS due to a malicious subkey in
the keyring.
* g10/getkey.c (get_pubkey): Factor code out to ...
(get_pubkey_bykid): new. Add feature to return the keyblock.
(get_pubkey_for_sig): Add arg r_keyblock to return the used keyblock.
Request a signing usage.
(get_pubkeyblock_for_sig): Remove.
(finish_lookup): Improve debug output.
* g10/sig-check.c (check_signature): Add arg r_keyblock and pass it
down.
* g10/mainproc.c (do_check_sig): Ditto.
(check_sig_and_print): Use the keyblock returned by do_check_sig to
show further information instead of looking it up again with
get_pubkeyblock_for_sig. Also re-check the signature after the import
of an included keyblock.
--
The problem here is that it is possible to import a key from someone
who added a signature subkey from another public key and thus inhibits
that a good signature good be verified.
Such a malicious key signature subkey must have been created w/o the
mandatory backsig which bind a signature subkey to its primary key.
For encryption subkeys this is not an issue because the existence of a
decryption private key is all you need to decrypt something and then
it does not matter if the public subkey or its binding signature has
been put below another primary key; in fact we do the latter for
ADSKs.
GnuPG-bug-id: 7527
Backported-from-master: 48978ccb4e20866472ef18436a32744350a65158
(cherry picked by dkg from commit
da0164efc7f32013bc24d97b9afa9f8d67c318bb with significant edits to
align with 2.2)
Reference link:
https://salsa.debian.org/debian/gnupg2/-/blob/debian/2.2.46-6/debian/patches/from-2.4/gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey-in-t.patch
Signed-off-by: baogen shang <baogen.shang@windriver.com>
---
g10/getkey.c | 105 ++++++++++++++++++++++++++++++------------------
g10/keydb.h | 10 ++++-
g10/mainproc.c | 96 +++++++++++++++++++++++++++++--------------
g10/packet.h | 2 +-
g10/pkclist.c | 2 +-
g10/sig-check.c | 24 +++++++----
6 files changed, 158 insertions(+), 81 deletions(-)
diff --git a/g10/getkey.c b/g10/getkey.c
index 4747176..bb23491 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -423,27 +423,50 @@ pk_from_block (PKT_public_key *pk, kbnode_t keyblock, kbnode_t found_key)
/* Specialized version of get_pubkey which retrieves the key based on
* information in SIG. In contrast to get_pubkey PK is required. IF
- * FORCED_PK is not NULL, this public key is used and copied to PK. */
+ * FORCED_PK is not NULL, this public key is used and copied to PK.
+ * If R_KEYBLOCK is not NULL the entire keyblock is stored there if
+ * found and FORCED_PK is not used; if not used or on error NULL is
+ * stored there. */
gpg_error_t
get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig,
- PKT_public_key *forced_pk)
+ PKT_public_key *forced_pk, kbnode_t *r_keyblock)
{
+ gpg_error_t err;
const byte *fpr;
size_t fprlen;
+ if (r_keyblock)
+ *r_keyblock = NULL;
+
if (forced_pk)
{
copy_public_key (pk, forced_pk);
return 0;
}
+ /* Make sure to request only keys cabable of signing. This makes
+ * sure that a subkey w/o a valid backsig or with bad usage flags
+ * will be skipped. */
+ pk->req_usage = PUBKEY_USAGE_SIG;
+
/* First try the new ISSUER_FPR info. */
fpr = issuer_fpr_raw (sig, &fprlen);
- if (fpr && !get_pubkey_byfprint (ctrl, pk, NULL, fpr, fprlen))
+ if (fpr && !get_pubkey_byfprint (ctrl, pk, r_keyblock, fpr, fprlen))
return 0;
+ if (r_keyblock)
+ {
+ release_kbnode (*r_keyblock);
+ *r_keyblock = NULL;
+ }
/* Fallback to use the ISSUER_KEYID. */
- return get_pubkey (ctrl, pk, sig->keyid);
+ err = get_pubkey_bykid (ctrl, pk, r_keyblock, sig->keyid);
+ if (err && r_keyblock)
+ {
+ release_kbnode (*r_keyblock);
+ *r_keyblock = NULL;
+ }
+ return err;
}
@@ -461,6 +484,10 @@ get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig,
* usage will be returned. As such, it is essential that
* PK->REQ_USAGE be correctly initialized!
*
+ * If R_KEYBLOCK is not NULL, then the first result's keyblock is
+ * returned in *R_KEYBLOCK. This should be freed using
+ * release_kbnode().
+ *
* Returns 0 on success, GPG_ERR_NO_PUBKEY if there is no public key
* with the specified key id, or another error code if an error
* occurs.
@@ -468,24 +495,30 @@ get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig,
* If the data was not read from the cache, then the self-signed data
* has definitely been merged into the public key using
* merge_selfsigs. */
-int
-get_pubkey (ctrl_t ctrl, PKT_public_key * pk, u32 * keyid)
+gpg_error_t
+get_pubkey_bykid (ctrl_t ctrl, PKT_public_key *pk, kbnode_t *r_keyblock,
+ u32 *keyid)
{
int internal = 0;
- int rc = 0;
+ gpg_error_t rc = 0;
+
+ if (r_keyblock)
+ *r_keyblock = NULL;
#if MAX_PK_CACHE_ENTRIES
- if (pk)
+ if (pk && !r_keyblock)
{
/* Try to get it from the cache. We don't do this when pk is
- NULL as it does not guarantee that the user IDs are
- cached. */
+ * NULL as it does not guarantee that the user IDs are cached.
+ * The old get_pubkey_function did not check PK->REQ_USAGE when
+ * reading form the caceh. This is probably a bug. Note that
+ * the cache is not used when the caller asked to return the
+ * entire keyblock. This is because the cache does not
+ * associate the public key wit its primary key. */
pk_cache_entry_t ce;
for (ce = pk_cache; ce; ce = ce->next)
{
if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1])
- /* XXX: We don't check PK->REQ_USAGE here, but if we don't
- read from the cache, we do check it! */
{
copy_public_key (pk, ce->pk);
return 0;
@@ -538,16 +571,18 @@ get_pubkey (ctrl_t ctrl, PKT_public_key * pk, u32 * keyid)
ctx.req_usage = pk->req_usage;
rc = lookup (ctrl, &ctx, 0, &kb, &found_key);
if (!rc)
+ pk_from_block (pk, kb, found_key);
+ getkey_end (ctrl, &ctx);
+ if (!rc && r_keyblock)
{
- pk_from_block (pk, kb, found_key);
+ *r_keyblock = kb;
+ kb = NULL;
}
- getkey_end (ctrl, &ctx);
release_kbnode (kb);
}
- if (!rc)
- goto leave;
- rc = GPG_ERR_NO_PUBKEY;
+ if (rc) /* Return a more useful error code. */
+ rc = gpg_error (GPG_ERR_NO_PUBKEY);
leave:
if (!rc)
@@ -558,6 +593,14 @@ leave:
}
+/* Wrapper for get_pubkey_bykid w/o keyblock return feature. */
+int
+get_pubkey (ctrl_t ctrl, PKT_public_key *pk, u32 *keyid)
+{
+ return get_pubkey_bykid (ctrl, pk, NULL, keyid);
+}
+
+
/* Same as get_pubkey but if the key was not found the function tries
* to import it from LDAP. FIXME: We should not need this but swicth
* to a fingerprint lookup. */
@@ -670,28 +713,6 @@ get_pubkey_fast (PKT_public_key * pk, u32 * keyid)
}
-/* Return the entire keyblock used to create SIG. This is a
- * specialized version of get_pubkeyblock.
- *
- * FIXME: This is a hack because get_pubkey_for_sig was already called
- * and it could have used a cache to hold the key. */
-kbnode_t
-get_pubkeyblock_for_sig (ctrl_t ctrl, PKT_signature *sig)
-{
- const byte *fpr;
- size_t fprlen;
- kbnode_t keyblock;
-
- /* First try the new ISSUER_FPR info. */
- fpr = issuer_fpr_raw (sig, &fprlen);
- if (fpr && !get_pubkey_byfprint (ctrl, NULL, &keyblock, fpr, fprlen))
- return keyblock;
-
- /* Fallback to use the ISSUER_KEYID. */
- return get_pubkeyblock (ctrl, sig->keyid);
-}
-
-
/* Return the key block for the key with key id KEYID or NULL, if an
* error occurs. Use release_kbnode() to release the key block.
*
@@ -3668,6 +3689,7 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
kbnode_t latest_key;
PKT_public_key *pk;
int req_prim;
+ int diag_exactfound = 0;
u32 curtime = make_timestamp ();
if (r_flags)
@@ -3698,6 +3720,7 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
foundk = k;
pk = k->pkt->pkt.public_key;
pk->flags.exact = 1;
+ diag_exactfound = 1;
break;
}
}
@@ -3718,10 +3741,14 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
log_debug ("finish_lookup: checking key %08lX (%s)(req_usage=%x)\n",
(ulong) keyid_from_pk (keyblock->pkt->pkt.public_key, NULL),
foundk ? "one" : "all", req_usage);
+ if (diag_exactfound && DBG_LOOKUP)
+ log_debug ("\texact search requested and found\n");
if (!req_usage)
{
latest_key = foundk ? foundk : keyblock;
+ if (DBG_LOOKUP)
+ log_debug ("\tno usage requested - accepting key\n");
goto found;
}
diff --git a/g10/keydb.h b/g10/keydb.h
index 7457479..ee512f2 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -318,9 +318,15 @@ void getkey_disable_caches(void);
/* Return the public key used for signature SIG and store it at PK. */
gpg_error_t get_pubkey_for_sig (ctrl_t ctrl,
PKT_public_key *pk, PKT_signature *sig,
- PKT_public_key *forced_pk);
+ PKT_public_key *forced_pk,
+ kbnode_t *r_keyblock);
-/* Return the public key with the key id KEYID and store it at PK. */
+/* Return the public key with the key id KEYID and store it at PK.
+ * Optionally return the entire keyblock. */
+gpg_error_t get_pubkey_bykid (ctrl_t ctrl, PKT_public_key *pk,
+ kbnode_t *r_keyblock, u32 *keyid);
+
+/* Same as get_pubkey_bykid but w/o r_keyblock. */
int get_pubkey (ctrl_t ctrl, PKT_public_key *pk, u32 *keyid);
/* Same as get_pubkey but with auto LDAP fetch. */
diff --git a/g10/mainproc.c b/g10/mainproc.c
index 8e788c3..f0cecec 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -1077,12 +1077,15 @@ proc_compressed (CTX c, PACKET *pkt)
* used to verify the signature will be stored there, or NULL if not
* found. If FORCED_PK is not NULL, this public key is used to verify
* _data signatures_ and no key lookup is done. Returns: 0 = valid
- * signature or an error code
+ * signature or an error code. If R_KEYBLOCK is not NULL the keyblock
+ * carries the used PK is stored there. The caller should always free
+ * the return value using release_kbnode.
*/
static int
do_check_sig (CTX c, kbnode_t node,
PKT_public_key *forced_pk, int *is_selfsig,
- int *is_expkey, int *is_revkey, PKT_public_key **r_pk)
+ int *is_expkey, int *is_revkey,
+ PKT_public_key **r_pk, kbnode_t *r_keyblock)
{
PKT_signature *sig;
gcry_md_hd_t md = NULL;
@@ -1092,6 +1095,8 @@ do_check_sig (CTX c, kbnode_t node,
if (r_pk)
*r_pk = NULL;
+ if (r_keyblock)
+ *r_keyblock = NULL;
log_assert (node->pkt->pkttype == PKT_SIGNATURE);
if (is_selfsig)
@@ -1169,7 +1174,8 @@ do_check_sig (CTX c, kbnode_t node,
(0x00) or text document (0x01). */
rc = check_signature (c->ctrl, sig, md,
forced_pk,
- NULL, is_expkey, is_revkey, r_pk);
+ NULL, is_expkey, is_revkey, r_pk,
+ r_keyblock);
if (! rc)
md_good = md;
else if (gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE && md2)
@@ -1179,7 +1185,8 @@ do_check_sig (CTX c, kbnode_t node,
rc = check_signature (c->ctrl, sig, md2,
forced_pk,
NULL, is_expkey, is_revkey,
- r_pk? &pk2 : NULL);
+ r_pk? &pk2 : NULL,
+ r_keyblock);
if (!rc)
{
md_good = md2;
@@ -1341,7 +1348,7 @@ list_node (CTX c, kbnode_t node)
if (opt.check_sigs)
{
fflush (stdout);
- rc2 = do_check_sig (c, node, NULL, &is_selfsig, NULL, NULL, NULL);
+ rc2 = do_check_sig (c, node, NULL, &is_selfsig, NULL, NULL, NULL, NULL);
switch (gpg_err_code (rc2))
{
case 0: sigrc = '!'; break;
@@ -1875,7 +1882,7 @@ check_sig_and_print (CTX c, kbnode_t node)
int is_revkey = 0;
char *issuer_fpr = NULL;
PKT_public_key *pk = NULL; /* The public key for the signature or NULL. */
- kbnode_t included_keyblock = NULL;
+ kbnode_t keyblock = NULL;
if (opt.skip_verify)
{
@@ -1989,7 +1996,8 @@ check_sig_and_print (CTX c, kbnode_t node)
{
ambiguous:
log_error(_("can't handle this ambiguous signature data\n"));
- return 0;
+ rc = 0;
+ goto leave;
}
}
@@ -2024,7 +2032,7 @@ check_sig_and_print (CTX c, kbnode_t node)
if (sig->signers_uid)
log_info (_(" issuer \"%s\"\n"), sig->signers_uid);
- rc = do_check_sig (c, node, NULL, NULL, &is_expkey, &is_revkey, &pk);
+ rc = do_check_sig (c, node, NULL, NULL, &is_expkey, &is_revkey, &pk, &keyblock);
/* If the key is not found but the signature includes a key block we
* use that key block for verification and on success import it. */
@@ -2032,6 +2040,7 @@ check_sig_and_print (CTX c, kbnode_t node)
&& sig->flags.key_block
&& opt.flags.auto_key_import)
{
+ kbnode_t included_keyblock = NULL;
PKT_public_key *included_pk;
const byte *kblock;
size_t kblock_len;
@@ -2043,8 +2052,13 @@ check_sig_and_print (CTX c, kbnode_t node)
kblock+1, kblock_len-1,
sig->keyid, &included_keyblock))
{
+ /* Note: This is the only place where we use the forced_pk
+ * arg (ie. included_pk) with do_check_sig. */
rc = do_check_sig (c, node, included_pk,
- NULL, &is_expkey, &is_revkey, &pk);
+ NULL, &is_expkey, &is_revkey, &pk, NULL);
+ if (opt.verbose)
+ log_info ("checked signature using included key block: %s\n",
+ gpg_strerror (rc));
if (!rc)
{
/* The keyblock has been verified, we now import it. */
@@ -2053,6 +2067,18 @@ check_sig_and_print (CTX c, kbnode_t node)
}
free_public_key (included_pk);
+ release_kbnode (included_keyblock);
+
+ /* To make sure that nothing strange happened we check the
+ * signature again now using our own key store. This also
+ * returns the keyblock which we use later on. */
+ if (!rc)
+ {
+ release_kbnode (keyblock);
+ keyblock = NULL;
+ rc = do_check_sig (c, node, NULL,
+ NULL, &is_expkey, &is_revkey, &pk, &keyblock);
+ }
}
/* If the key isn't found, check for a preferred keyserver. Note
@@ -2099,8 +2125,13 @@ check_sig_and_print (CTX c, kbnode_t node)
KEYSERVER_IMPORT_FLAG_QUICK);
glo_ctrl.in_auto_key_retrieve--;
if (!res)
- rc = do_check_sig (c, node, NULL,
- NULL, &is_expkey, &is_revkey, &pk);
+ {
+ release_kbnode (keyblock);
+ keyblock = NULL;
+ rc = do_check_sig (c, node, NULL,
+ NULL, &is_expkey, &is_revkey, &pk,
+ &keyblock);
+ }
else if (DBG_LOOKUP)
log_debug ("lookup via %s failed: %s\n", "Pref-KS",
gpg_strerror (res));
@@ -2141,7 +2172,12 @@ check_sig_and_print (CTX c, kbnode_t node)
/* Fixme: If the fingerprint is embedded in the signature,
* compare it to the fingerprint of the returned key. */
if (!res)
- rc = do_check_sig (c, node, NULL, NULL, &is_expkey, &is_revkey, &pk);
+ {
+ release_kbnode (keyblock);
+ keyblock = NULL;
+ rc = do_check_sig (c, node, NULL, NULL, &is_expkey, &is_revkey, &pk,
+ &keyblock);
+ }
else if (DBG_LOOKUP)
log_debug ("lookup via %s failed: %s\n", "WKD", gpg_strerror (res));
}
@@ -2176,7 +2212,7 @@ check_sig_and_print (CTX c, kbnode_t node)
free_keyserver_spec (spec);
if (!res)
rc = do_check_sig (c, node, NULL,
- NULL, &is_expkey, &is_revkey, &pk);
+ NULL, &is_expkey, &is_revkey, &pk, NULL);
else if (DBG_LOOKUP)
log_debug ("lookup via %s failed: %s\n", "PKA",
gpg_strerror (res));
@@ -2209,8 +2245,13 @@ check_sig_and_print (CTX c, kbnode_t node)
KEYSERVER_IMPORT_FLAG_QUICK);
glo_ctrl.in_auto_key_retrieve--;
if (!res)
- rc = do_check_sig (c, node, NULL,
- NULL, &is_expkey, &is_revkey, &pk);
+ {
+ release_kbnode (keyblock);
+ keyblock = NULL;
+ rc = do_check_sig (c, node, NULL,
+ NULL, &is_expkey, &is_revkey, &pk,
+ &keyblock);
+ }
else if (DBG_LOOKUP)
log_debug ("lookup via %s failed: %s\n", "KS", gpg_strerror (res));
}
@@ -2218,7 +2259,9 @@ check_sig_and_print (CTX c, kbnode_t node)
if (!rc || gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE)
{
- kbnode_t un, keyblock;
+ /* We have checked the signature and the result is either a good
+ * signature or a bad signature. Further examination follows. */
+ kbnode_t un;
int count = 0;
int statno;
char keyid_str[50];
@@ -2235,18 +2278,6 @@ check_sig_and_print (CTX c, kbnode_t node)
else
statno = STATUS_GOODSIG;
- /* FIXME: We should have the public key in PK and thus the
- * keyblock has already been fetched. Thus we could use the
- * fingerprint or PK itself to lookup the entire keyblock. That
- * would best be done with a cache. */
- if (included_keyblock)
- {
- keyblock = included_keyblock;
- included_keyblock = NULL;
- }
- else
- keyblock = get_pubkeyblock_for_sig (c->ctrl, sig);
-
snprintf (keyid_str, sizeof keyid_str, "%08lX%08lX [uncertain] ",
(ulong)sig->keyid[0], (ulong)sig->keyid[1]);
@@ -2300,7 +2331,12 @@ check_sig_and_print (CTX c, kbnode_t node)
count++;
}
- log_assert (mainpk);
+ if (!mainpk)
+ {
+ log_error ("signature key lost from keyblock (%p,%p)\n",
+ keyblock, mainpk);
+ rc = gpg_error (GPG_ERR_INTERNAL);
+ }
/* In case we did not found a valid textual userid above
we print the first user id packet or a "[?]" instead along
@@ -2558,8 +2594,8 @@ check_sig_and_print (CTX c, kbnode_t node)
log_error (_("Can't check signature: %s\n"), gpg_strerror (rc));
}
+ leave:
free_public_key (pk);
- release_kbnode (included_keyblock);
xfree (issuer_fpr);
return rc;
}
diff --git a/g10/packet.h b/g10/packet.h
index c40401a..6a8ac79 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -891,7 +891,7 @@ gpg_error_t check_signature (ctrl_t ctrl,
PKT_signature *sig, gcry_md_hd_t digest,
PKT_public_key *forced_pk,
u32 *r_expiredate, int *r_expired, int *r_revoked,
- PKT_public_key **r_pk);
+ PKT_public_key **r_pk, kbnode_t *r_keyblock);
/*-- pubkey-enc.c --*/
diff --git a/g10/pkclist.c b/g10/pkclist.c
index bfc4f84..21c37fe 100644
--- a/g10/pkclist.c
+++ b/g10/pkclist.c
@@ -548,7 +548,7 @@ check_signatures_trust (ctrl_t ctrl, PKT_signature *sig)
unsigned int trustlevel = TRUST_UNKNOWN;
int rc=0;
- rc = get_pubkey_for_sig (ctrl, pk, sig, NULL);
+ rc = get_pubkey_for_sig (ctrl, pk, sig, NULL, NULL);
if (rc)
{ /* this should not happen */
log_error("Ooops; the key vanished - can't check the trust\n");
diff --git a/g10/sig-check.c b/g10/sig-check.c
index a29470f..7194949 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -102,13 +102,19 @@ sig_check_dump_stats (void)
* If R_PK is not NULL, the public key is stored at that address if it
* was found; other wise NULL is stored.
*
+ * If R_KEYBLOCK is not NULL, the entire keyblock used to verify the
+ * signature is stored at that address. If no key was found or on
+ * some other errors NULL is stored there. The callers needs to
+ * release the keyblock using release_kbnode (kb).
+ *
* Returns 0 on success. An error code otherwise. */
gpg_error_t
check_signature (ctrl_t ctrl,
PKT_signature *sig, gcry_md_hd_t digest,
PKT_public_key *forced_pk,
u32 *r_expiredate,
- int *r_expired, int *r_revoked, PKT_public_key **r_pk)
+ int *r_expired, int *r_revoked, PKT_public_key **r_pk,
+ kbnode_t *r_keyblock)
{
int rc=0;
PKT_public_key *pk;
@@ -121,6 +127,8 @@ check_signature (ctrl_t ctrl,
*r_revoked = 0;
if (r_pk)
*r_pk = NULL;
+ if (r_keyblock)
+ *r_keyblock = NULL;
pk = xtrycalloc (1, sizeof *pk);
if (!pk)
@@ -151,7 +159,7 @@ check_signature (ctrl_t ctrl,
log_info(_("WARNING: signature digest conflict in message\n"));
rc = gpg_error (GPG_ERR_GENERAL);
}
- else if (get_pubkey_for_sig (ctrl, pk, sig, forced_pk))
+ else if (get_pubkey_for_sig (ctrl, pk, sig, forced_pk, r_keyblock))
rc = gpg_error (GPG_ERR_NO_PUBKEY);
else if (!gnupg_pk_is_allowed (opt.compliance, PK_USE_VERIFICATION,
pk->pubkey_algo, 0, pk->pkey,
@@ -700,9 +708,9 @@ check_revocation_keys (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig)
keyid_from_fingerprint (ctrl, pk->revkey[i].fpr,
MAX_FINGERPRINT_LEN, keyid);
- if(keyid[0]==sig->keyid[0] && keyid[1]==sig->keyid[1])
- /* The signature was generated by a designated revoker.
- Verify the signature. */
+ /* If the signature was generated by a designated revoker
+ * verify the signature. */
+ if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1])
{
gcry_md_hd_t md;
@@ -710,9 +718,9 @@ check_revocation_keys (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig)
BUG ();
hash_public_key(md,pk);
/* Note: check_signature only checks that the signature
- is good. It does not fail if the key is revoked. */
+ * is good. It does not fail if the key is revoked. */
rc = check_signature (ctrl, sig, md, NULL, 0, NULL,
- NULL, NULL, NULL, NULL);
+ NULL, NULL, NULL);
cache_sig_result(sig,rc);
gcry_md_close (md);
break;
@@ -918,7 +926,7 @@ check_signature_over_key_or_uid (ctrl_t ctrl, PKT_public_key *signer,
if (IS_CERT (sig))
signer->req_usage = PUBKEY_USAGE_CERT;
- rc = get_pubkey_for_sig (ctrl, signer, sig, NULL);
+ rc = get_pubkey_for_sig (ctrl, signer, sig, NULL, NULL);
if (rc)
{
if (signer_alloced != 1)
--
2.33.0

182
backport-0004-CVE-2025-30258-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch Normal file
View File

@ -0,0 +1,182 @@
From 3339c147b6f5b684900e2721929d52021682a761 Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Thu, 6 Mar 2025 17:17:17 +0100
Subject: [PATCH 4/4] gpg: Fix regression for the recent malicious subkey DoS
fix.
* g10/packet.h (PUBKEY_USAGE_VERIFY): New.
* g10/getkey.c (get_pubkey_for_sig): Pass new flag also to requested
usage.
(finish_lookup): Introduce a verify_mode.
--
Fixes-commit: da0164efc7f32013bc24d97b9afa9f8d67c318bb
GnuPG-bug-id: 7547
Reference link:
https://salsa.debian.org/debian/gnupg2/-/blob/debian/2.2.46-6/debian/patches/from-2.4/gpg-Fix-regression-for-the-recent-malicious-subkey-DoS-fi.patch
Signed-off-by: baogen shang <baogen.shang@windriver.com>
---
g10/getkey.c | 43 +++++++++++++++++++++++++++----------------
g10/packet.h | 1 +
2 files changed, 28 insertions(+), 16 deletions(-)
diff --git a/g10/getkey.c b/g10/getkey.c
index bb23491..ce5c46f 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -422,11 +422,12 @@ pk_from_block (PKT_public_key *pk, kbnode_t keyblock, kbnode_t found_key)
/* Specialized version of get_pubkey which retrieves the key based on
- * information in SIG. In contrast to get_pubkey PK is required. IF
+ * information in SIG. In contrast to get_pubkey PK is required. If
* FORCED_PK is not NULL, this public key is used and copied to PK.
* If R_KEYBLOCK is not NULL the entire keyblock is stored there if
* found and FORCED_PK is not used; if not used or on error NULL is
- * stored there. */
+ * stored there. Use this function only to find the key for
+ * verification; it can't be used to select a key for signing. */
gpg_error_t
get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig,
PKT_public_key *forced_pk, kbnode_t *r_keyblock)
@@ -446,8 +447,9 @@ get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig,
/* Make sure to request only keys cabable of signing. This makes
* sure that a subkey w/o a valid backsig or with bad usage flags
- * will be skipped. */
- pk->req_usage = PUBKEY_USAGE_SIG;
+ * will be skipped. We also request the verification mode so that
+ * expired and reoked keys are returned. */
+ pk->req_usage = (PUBKEY_USAGE_SIG | PUBKEY_USAGE_VERIFY);
/* First try the new ISSUER_FPR info. */
fpr = issuer_fpr_raw (sig, &fprlen);
@@ -511,10 +513,10 @@ get_pubkey_bykid (ctrl_t ctrl, PKT_public_key *pk, kbnode_t *r_keyblock,
/* Try to get it from the cache. We don't do this when pk is
* NULL as it does not guarantee that the user IDs are cached.
* The old get_pubkey_function did not check PK->REQ_USAGE when
- * reading form the caceh. This is probably a bug. Note that
+ * reading from the cache. This is probably a bug. Note that
* the cache is not used when the caller asked to return the
* entire keyblock. This is because the cache does not
- * associate the public key wit its primary key. */
+ * associate the public key with its primary key. */
pk_cache_entry_t ce;
for (ce = pk_cache; ce; ce = ce->next)
{
@@ -3690,11 +3692,18 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
PKT_public_key *pk;
int req_prim;
int diag_exactfound = 0;
+ int verify_mode = 0;
u32 curtime = make_timestamp ();
if (r_flags)
*r_flags = 0;
+
+ /* The verify mode is used to change the behaviour so that we can
+ * return an expired or revoked key for signature verification. */
+ verify_mode = ((req_usage & PUBKEY_USAGE_VERIFY)
+ && (req_usage & PUBKEY_USAGE_SIG));
+
#define USAGE_MASK (PUBKEY_USAGE_SIG|PUBKEY_USAGE_ENC|PUBKEY_USAGE_CERT)
req_usage &= USAGE_MASK;
@@ -3738,9 +3747,9 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
}
if (DBG_LOOKUP)
- log_debug ("finish_lookup: checking key %08lX (%s)(req_usage=%x)\n",
+ log_debug ("finish_lookup: checking key %08lX (%s)(req_usage=%x%s)\n",
(ulong) keyid_from_pk (keyblock->pkt->pkt.public_key, NULL),
- foundk ? "one" : "all", req_usage);
+ foundk ? "one" : "all", req_usage, verify_mode? ",verify":"");
if (diag_exactfound && DBG_LOOKUP)
log_debug ("\texact search requested and found\n");
@@ -3802,28 +3811,28 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
}
n_subkeys++;
- if (pk->flags.revoked)
+ if (!verify_mode && pk->flags.revoked)
{
if (DBG_LOOKUP)
log_debug ("\tsubkey has been revoked\n");
n_revoked_or_expired++;
continue;
}
- if (pk->has_expired)
+ if (!verify_mode && pk->has_expired)
{
if (DBG_LOOKUP)
log_debug ("\tsubkey has expired\n");
n_revoked_or_expired++;
continue;
}
- if (pk->timestamp > curtime && !opt.ignore_valid_from)
+ if (!verify_mode && pk->timestamp > curtime && !opt.ignore_valid_from)
{
if (DBG_LOOKUP)
log_debug ("\tsubkey not yet valid\n");
continue;
}
- if (want_secret && agent_probe_secret_key (NULL, pk))
+ if (!verify_mode && want_secret && agent_probe_secret_key (NULL, pk))
{
if (DBG_LOOKUP)
log_debug ("\tno secret key\n");
@@ -3831,7 +3840,8 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
}
if (DBG_LOOKUP)
- log_debug ("\tsubkey might be fine\n");
+ log_debug ("\tsubkey might be fine%s\n",
+ verify_mode? " for verification":"");
/* In case a key has a timestamp of 0 set, we make sure
that it is used. A better change would be to compare
">=" but that might also change the selected keys and
@@ -3872,12 +3882,12 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
log_debug ("\tprimary key usage does not match: "
"want=%x have=%x\n", req_usage, pk->pubkey_usage);
}
- else if (pk->flags.revoked)
+ else if (!verify_mode && pk->flags.revoked)
{
if (DBG_LOOKUP)
log_debug ("\tprimary key has been revoked\n");
}
- else if (pk->has_expired)
+ else if (!verify_mode && pk->has_expired)
{
if (DBG_LOOKUP)
log_debug ("\tprimary key has expired\n");
@@ -3885,7 +3895,8 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
else /* Okay. */
{
if (DBG_LOOKUP)
- log_debug ("\tprimary key may be used\n");
+ log_debug ("\tprimary key may be used%s\n",
+ verify_mode? " for verification":"");
latest_key = keyblock;
}
}
diff --git a/g10/packet.h b/g10/packet.h
index 6a8ac79..ca7aad9 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -135,6 +135,7 @@ typedef struct {
gcry_mpi_t data[PUBKEY_MAX_NENC];
} PKT_pubkey_enc;
+#define PUBKEY_USAGE_VERIFY 16384 /* Verify only modifier. */
/* A one-pass signature packet as defined in RFC 4880, Section
5.4. All fields are serialized. */
--
2.33.0

54
backport-0005-CVE-2025-30258-gpg-Allow-the-use-of-an-ADSK-subkey-as-ADSK-subkey.patch Normal file
View File

@ -0,0 +1,54 @@
From 660926a5cd6daedab2f7b9df935bb3f7f5776169 Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Thu, 31 Oct 2024 15:11:55 +0100
Subject: [PATCH] gpg: Allow the use of an ADSK subkey as ADSK subkey.
* g10/packet.h (PKT_public_key): Increased size of req_usage to 16.
* g10/getkey.c (key_byname): Set allow_adsk in the context if ir was
requested via req_usage.
(finish_lookup): Allow RENC usage matching.
* g10/keyedit.c (append_adsk_to_key): Adjust the assert.
* g10/keygen.c (prepare_adsk): Also allow to find an RENC subkey.
--
If an ADSK is to be added it may happen that an ADSK subkey is found
first and this should then be used even that it does not have the E
usage. However, it used to have that E usage when it was added.
While testing this I found another pecularity: If you do
gpg -k ADSK_SUBKEY_FPR
without the '!' suffix and no corresponding encryption subkey is dound,
you will get an unusabe key error. I hesitate to fix that due to
possible side-effects.
GnuPG-bug-id: 6882
Backported-from-master: d30e345692440b9c6677118c1d20b9d17d80f873
Reference link:
https://dev.gnupg.org/rG794950ec755eab3729d5a5905cbbc2e2d98b8699
(sbg: for fixing the poc failed, we only backport the type of req_usage change line)
Note that we still use the NO_AKL and not the newer TRY_LDAP in 2.2.
We may want to backport that change as well.
Signed-off-by: baogen shang <baogen.shang@windriver.com>
---
g10/packet.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/g10/packet.h b/g10/packet.h
index ca7aad9..9e7685c 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -387,7 +387,7 @@ typedef struct
/* The public key algorithm. (Serialized.) */
byte pubkey_algo;
byte pubkey_usage; /* for now only used to pass it to getkey() */
- byte req_usage; /* hack to pass a request to getkey() */
+ u16 req_usage; /* hack to pass a request to getkey() */
u32 has_expired; /* set to the expiration date if expired */
/* keyid of the primary key. Never access this value directly.
Instead, use pk_main_keyid(). */
--
2.33.0

48
backport-0006-CVE-2025-30258-gpg-Fix-another-regression-due-to-the-T7547-fix.patch Normal file
View File

@ -0,0 +1,48 @@
From 9b7c067717d815e16f9ea3cec88bca09a6cce7cb Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Fri, 2 May 2025 11:11:05 +0200
Subject: [PATCH] gpg: Fix another regression due to the T7547 fix.
* g10/getkey.c (get_pubkey_for_sig): Keep a requested
PUBKEY_USAGE_CERT.
(finish_lookup): For correctness in future use cases allow
PUBKEY_USAGE_CERT to also trigger verify mode.
--
The case here was that a cert-only primary key was removed with
export-clean.
GnuPG-bug-id: 7583
---
g10/getkey.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/g10/getkey.c b/g10/getkey.c
index e3264062f..ae0e00220 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -341,8 +341,10 @@ get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key *pk, PKT_signature *sig,
/* Make sure to request only keys cabable of signing. This makes
* sure that a subkey w/o a valid backsig or with bad usage flags
* will be skipped. We also request the verification mode so that
- * expired and reoked keys are returned. */
- pk->req_usage = (PUBKEY_USAGE_SIG | PUBKEY_USAGE_VERIFY);
+ * expired and revoked keys are returned. We keep only a requested
+ * CERT usage in PK for the sake of key signatures. */
+ pk->req_usage = (PUBKEY_USAGE_SIG | PUBKEY_USAGE_VERIFY
+ | (pk->req_usage & PUBKEY_USAGE_CERT));
/* First try the new ISSUER_FPR info. */
fpr = issuer_fpr_raw (sig, &fprlen);
@@ -3736,7 +3738,7 @@ finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
/* The verify mode is used to change the behaviour so that we can
* return an expired or revoked key for signature verification. */
verify_mode = ((req_usage & PUBKEY_USAGE_VERIFY)
- && (req_usage & PUBKEY_USAGE_SIG));
+ && (req_usage & (PUBKEY_USAGE_CERT|PUBKEY_USAGE_SIG)));
#define USAGE_MASK (PUBKEY_USAGE_SIG|PUBKEY_USAGE_ENC|PUBKEY_USAGE_CERT)
req_usage &= USAGE_MASK;
--
2.43.0

11
gnupg2.spec
View File

@ -1,6 +1,6 @@
Name: gnupg2
Version: 2.2.32
Release: 6
Release: 7
Summary: Utility for secure communication and data storage
License: GPLv3+
@ -23,6 +23,12 @@ Patch11: common-Avoid-undefined-behavior-of-left-shift-operat.patch
Patch12: backport-CVE-2022-34903.patch
Patch13: backport-common-Protect-against-a-theoretical-integer-overflow.patch
Patch14: backport-gpg-Fix-double-free-of-internal-data.patch
Patch15: backport-0001-CVE-2025-30258-gpg-Lookup-key-for-merging-inserting-only-by-primary.patch
Patch16: backport-0002-CVE-2025-30258-gpg-Remove-a-signature-check-function-wrapper.patch
Patch17: backport-0003-CVE-2025-30258-gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey.patch
Patch18: backport-0004-CVE-2025-30258-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch
Patch19: backport-0005-CVE-2025-30258-gpg-Allow-the-use-of-an-ADSK-subkey-as-ADSK-subkey.patch
Patch20: backport-0006-CVE-2025-30258-gpg-Fix-another-regression-due-to-the-T7547-fix.patch
BuildRequires: gcc
BuildRequires: zlib-devel, npth-devel, texinfo
@ -120,6 +126,9 @@ make check
%changelog
* Tue May 6 2025 yixiangzhike <yixiangzhike007@163.com> - 2.2.32-7
- fix CVE-2025-30258
* Fri Mar 21 2025 yixiangzhike <yixiangzhike007@163.com> - 2.2.32-6
- backport upstream patch to fix double free