Bug 1773 - PKCS#11 authentication fails with "xmalloc: zero size" for some certificates.
Summary: PKCS#11 authentication fails with "xmalloc: zero size" for some certificates.
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: Smartcard (show other bugs)
Version: 7.1p1
Hardware: All All
: P2 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: V_7_2
  Show dependency treegraph
 
Reported: 2010-06-03 05:40 AEST by Matt Robinson
Modified: 2018-04-06 12:26 AEST (History)
3 users (show)

See Also:


Attachments
Patch to fix xmalloc error when using pkcs11 for auth (873 bytes, patch)
2010-06-03 05:40 AEST, Matt Robinson
no flags Details | Diff
Patch to fix xmalloc error when using pkcs11 for auth for 7.x releases (734 bytes, patch)
2015-09-23 21:24 AEST, Sergey Ivanov
evasive.gyron: ok+
Details | Diff
Avoid xmalloc(0) (671 bytes, patch)
2015-09-24 16:26 AEST, Damien Miller
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Matt Robinson 2010-06-03 05:40:31 AEST
Created attachment 1851 [details]
Patch to fix xmalloc error when using pkcs11 for auth

I've been trying to use an Aladdin eToken PRO 64k (4.2) USB smart card for public key ssh authentication (using the -I option with the PKCS11 library for the eToken), but OpenSSH would abort with the message:

xmalloc: zero size

I tracked this down to the pkcs11_fetch_keys function in ssh-pkcs11.c, and discovered that C_GetAttributeValue returns a ulValueLen of 0 for some of the attributes for some of my certificates.  I believe that this may be being caused by some CA certificates that I also have on the eToken, which are stored without their private keys.

The attached patch (against CVS) resolves this issue by skipping to the next certificate if any of the three attributes are returned as having zero length.  This should not affect operation for users currently not experiencing this error.

I'm using Cygwin under Windows 7 x64, but I believe that this would happen on other platforms, so I've set Hardware and OS to All.
Comment 1 Damien Miller 2010-06-10 14:48:29 AEST
Fix applied - this will be in OpenSSH 5.6. Thanks!
Comment 2 Damien Miller 2011-01-24 12:33:55 AEDT
Move resolved bugs to CLOSED after 5.7 release
Comment 3 Sergey Ivanov 2015-09-23 21:24:44 AEST
Created attachment 2713 [details]
Patch to fix xmalloc error when using pkcs11 for auth for 7.x releases
Comment 4 Sergey Ivanov 2015-09-23 21:26:01 AEST
This problem reappeared in openssh 7.x releases.

Attached patch should fix the problem.
Comment 5 Jakub Jelen 2015-09-23 23:24:59 AEST
This is related to the bug #2429 (see proposed and applied patch with check of the length before calling xmalloc in attachment #2670 [details]).

Your original error should not appear again, because the check for length is at the moment before calling xmalloc. 

The note in the code and in linked bugzilla says that the CKA_ID is allowed to be empty. Can you elaborate more on what problems you see at the moment?
Comment 6 Sergey Ivanov 2015-09-24 01:58:50 AEST
Error is exactly as described by original author.

ssh -A -I /usr/lib/libeToken.so -p example.net -vvv
OpenSSH_7.1p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Connecting to example.com [0000:1111:2222:3333:4444:5555] port 21.
debug1: Connection established.
debug1: manufacturerID <SafeNet, Inc.> cryptokiVersion 2.20 libraryDescription <SafeNet eToken PKCS#11> libraryVersion 9.0
debug1: label <eToken> manufacturerID <SafeNet, Inc.> model <eToken> serial <01234567> flags 0x60d
debug1: have 1 keys
debug1: have 2 keys
xmalloc: zero size

Output with sensitive data removed.
Comment 7 Damien Miller 2015-09-24 16:26:18 AEST
Created attachment 2714 [details]
Avoid xmalloc(0)

Please try this patch.
Comment 8 Sergey Ivanov 2015-09-24 18:07:34 AEST
Provided patch corrects the xmalloc error.

Thanks.
Comment 9 Sergey Ivanov 2016-01-19 17:24:20 AEDT
Any updates on status of this patch?
Will it be included in next release?
Comment 10 Damien Miller 2016-02-12 11:23:44 AEDT
Applied, this will be in openssh-7.2

commit d2d772f55b19bb0e8d03c2fe1b9bb176d9779efd
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Feb 12 00:20:30 2016 +0000

    upstream commit
    
    avoid fatal() for PKCS11 tokens that present empty key IDs
     bz#1773, ok markus@
    
    Upstream-ID: 044a764fee526f2c4a9d530bd10695422d01fc54
Comment 11 Damien Miller 2018-04-06 12:26:52 AEST
Close all resolved bugs after release of OpenSSH 7.7.