[Bug 1960863] [NEW] armv8 paca: poly1305 users see segfaults when pointer authentication in use on AWS Graviton 3 instances

[Matthew Ruffell]

Public bug reported:

[Impact]

Support for hardware pointer authentication for armv8 systems was merged
in openssl 1.1.1f, but it contains a bug in the implementation for
poly1305 message authenticated code routines, which causes the calling
program to fail pointer authentication, which causes the program to
crash with a segmentation fault.

You can easily test it by accessing any website that uses poly1305.
There is no workaround except use a different MAC.

[Testcase]

This bug applies to armv8 systems which support pointer authentication.
Start an armv8 instance, such as a c7g graviton 3 instance on AWS, and
make sure the paca flag is present in lscpu:

$ grep paca /proc/cpuinfo
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 sm3 sm4 asimddp sha512 sve asimdfhm dit uscat ilrcpc flagm ssbs paca pacg dcpodp svei8mm svebf16 i8mm bf16 dgh rng

Next, attempt to connect to any website that uses poly1305 MAC.

$ curl https://services.gradle.org/distributions/gradle-7.2-bin.zip --output gradle-7.2.bin
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0Segmentation fault (core dumped)

There is a test package available in the following ppa:

https://launchpad.net/~mruffell/+archive/ubuntu/sf327917-test

Install it, and poly1305 operations will no longer segfault.

[Where problems could occur]

The patch changes the order of operations for loading the SP and
checking the AUTIASP against it, from checking the AUTIASP against
nothing then loading the correct SP to check with, to the correct
loading the SP and then checking the AUTIASP against the SP.

This only changes one code path for armv8 systems, and other
architectures are not affected. This is also only limited to poly1305
MAC.

If a regression were to occur, it would only affect users of poly1035
MAC on armv8 with pacs support.

[Other info]

The fix landed upstream in openssl 1.1.1i with the following commit:

commit 5795acffd8706e1cb584284ee5bb3a30986d0e75
Author: Ard Biesheuvel <ard.biesheuvel at arm.com>
Date:   Tue Oct 27 18:02:40 2020 +0100
Subject: crypto/poly1305/asm: fix armv8 pointer authentication
Link: https://github.com/openssl/openssl/commit/5795acffd8706e1cb584284ee5bb3a30986d0e75

This commit is already present in Impish onward. Only Focal needs the
fix.

** Affects: openssl (Ubuntu)
     Importance: Undecided
         Status: Fix Released

** Affects: openssl (Ubuntu Focal)
     Importance: High
     Assignee: Matthew Ruffell (mruffell)
         Status: In Progress


** Tags: focal sts

** Also affects: openssl (Ubuntu Focal)
   Importance: Undecided
       Status: New

** Changed in: openssl (Ubuntu)
       Status: New => Fix Released

** Changed in: openssl (Ubuntu Focal)
       Status: New => In Progress

** Changed in: openssl (Ubuntu Focal)
   Importance: Undecided => High

** Changed in: openssl (Ubuntu Focal)
     Assignee: (unassigned) => Matthew Ruffell (mruffell)

** Tags added: focal sts

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssl in Ubuntu.
https://bugs.launchpad.net/bugs/1960863

Title:
  armv8 paca: poly1305 users see segfaults when pointer authentication
  in use on AWS Graviton 3 instances

Status in openssl package in Ubuntu:
  Fix Released
Status in openssl source package in Focal:
  In Progress

Bug description:
  [Impact]

  Support for hardware pointer authentication for armv8 systems was
  merged in openssl 1.1.1f, but it contains a bug in the implementation
  for poly1305 message authenticated code routines, which causes the
  calling program to fail pointer authentication, which causes the
  program to crash with a segmentation fault.

  You can easily test it by accessing any website that uses poly1305.
  There is no workaround except use a different MAC.

  [Testcase]

  This bug applies to armv8 systems which support pointer
  authentication. Start an armv8 instance, such as a c7g graviton 3
  instance on AWS, and make sure the paca flag is present in lscpu:

  $ grep paca /proc/cpuinfo
  Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm jscvt fcma lrcpc dcpop sha3 sm3 sm4 asimddp sha512 sve asimdfhm dit uscat ilrcpc flagm ssbs paca pacg dcpodp svei8mm svebf16 i8mm bf16 dgh rng

  Next, attempt to connect to any website that uses poly1305 MAC.

  $ curl https://services.gradle.org/distributions/gradle-7.2-bin.zip --output gradle-7.2.bin
  % Total % Received % Xferd Average Speed Time Time Time Current
  Dload Upload Total Spent Left Speed
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0Segmentation fault (core dumped)

  There is a test package available in the following ppa:

  https://launchpad.net/~mruffell/+archive/ubuntu/sf327917-test

  Install it, and poly1305 operations will no longer segfault.

  [Where problems could occur]

  The patch changes the order of operations for loading the SP and
  checking the AUTIASP against it, from checking the AUTIASP against
  nothing then loading the correct SP to check with, to the correct
  loading the SP and then checking the AUTIASP against the SP.

  This only changes one code path for armv8 systems, and other
  architectures are not affected. This is also only limited to poly1305
  MAC.

  If a regression were to occur, it would only affect users of poly1035
  MAC on armv8 with pacs support.

  [Other info]

  The fix landed upstream in openssl 1.1.1i with the following commit:

  commit 5795acffd8706e1cb584284ee5bb3a30986d0e75
  Author: Ard Biesheuvel <ard.biesheuvel at arm.com>
  Date:   Tue Oct 27 18:02:40 2020 +0100
  Subject: crypto/poly1305/asm: fix armv8 pointer authentication
  Link: https://github.com/openssl/openssl/commit/5795acffd8706e1cb584284ee5bb3a30986d0e75

  This commit is already present in Impish onward. Only Focal needs the
  fix.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1960863/+subscriptions