LibreSSL RNG bug fix: What's all the forking fuss about, ask devs

Blow to bit-spitter 'tis but a flesh wound, claim team


A bug found and fixed in LibreSSL, the OpenSSL fork maintained by OpenBSD developers, is “catastrophic" or "overblown", depending on whom you talk to.

Just days after the release of a portable version of the crypto library, a flaw was reported in LibreSSL's pseudo-random number generator – its PRNG, a vital component in strong encryption.‬

Andrew Ayer was able to write a program that could call LibreSSL's PRNG twice and get back the exact same stream of bits each time, which is not supposed to happen. Ayer, the founder of secure backup company Opsmate, described this bug as a “catastrophic failure of the PRNG.”

The OpenBSD project rejected this assessment as "overblown", and instead said the glitch was "minor". Nonetheless, the team promptly addressed the problem in LibreSSL version 2.0.2 and released it.

OpenBSD contributor Bob Beck reckoned a "contrived test program", such as the one produced by Ayer, was needed to reproduce the bug.

“While it’s a real issue, it’s actually a fairly minor one, because real applications don’t work the way the author describes, both because the PID (process identification number) issue would be very difficult to have become a real issue in real software, and nobody writes real software with OpenSSL the way the author has set this test up in the article,” Beck told Kaspersky Labs' Threatpost news service.

Ayer's fork_rand proof-of-concept code exploited the fact that fork()ing a program linked with LibreSSL produces a child process with the same PRNG state as the parent – meaning they will both spit out the same sequence of pseudo-random numbers.

This is not particularly brilliant because it means, for example, one process knows what another's random bit stream will look like, and these bit streams are used to generate secure encryption keys. Secrets will be leaked, in other words.

LibreSSL tries to detect when it is running in a fork()ed process by checking its process ID (PID): a change in PID means it is running in a new child, and duly resets its PRNG state to produce different numbers.

But the PID on Linux is 16 bits wide by default, and overflows when it hits that limit. If a program fork()s hard enough, a child could end up reusing a grandparent's PID and the aforementioned reseed check fails.

"You may think that fork_rand is a contrived example or that it's unlikely in practice for a process to end up with the same PID as its grandparent," wrote Ayer on his blog.

"You may be right, but for security-critical code this is not a strong enough guarantee. Attackers often find extremely creative ways to manufacture scenarios favorable for attacks, even when those scenarios are unlikely to occur under normal circumstances."

Bugs in PRNG components are a big deal because they weaken cryptographic systems. The NSA-championed Dual EC DRBG PRNG, which was offered as a default in the RSA BSAFE cryptography library, was found to be hopelessly flawed – so much so, it's believed Uncle Sam's spies deliberately knackered it with a backdoor.

LibreSSL forked from the OpenSSL cryptographic software library in April 2014 following the discovery of the password-leaking Heartbleed bug in OpenSSL; the vulnerability was severe enough that the OpenBSD gang decided to overhaul the crucial library, used in countless computers and devices for encryption and decryption.

Despite remaining critical of the way LibreSSL developers handled his bug report, Ayer remains broadly supportive of the project. "I really appreciate the work the LibreSSL devs are doing, especially their willingness to solicit feedback from the community and act on it," he said.

The fix, by the way, is to trap calls to fork() and act accordingly, rather than sense a PID change, but it may not be a perfect solution. ®

Similar topics

Broader topics


Other stories you might like

  • How ICE became a $2.8b domestic surveillance agency
    Your US tax dollars at work

    The US Immigration and Customs Enforcement (ICE) agency has spent about $2.8 billion over the past 14 years on a massive surveillance "dragnet" that uses big data and facial-recognition technology to secretly spy on most Americans, according to a report from Georgetown Law's Center on Privacy and Technology.

    The research took two years and included "hundreds" of Freedom of Information Act requests, along with reviews of ICE's contracting and procurement records. It details how ICE surveillance spending jumped from about $71 million annually in 2008 to about $388 million per year as of 2021. The network it has purchased with this $2.8 billion means that "ICE now operates as a domestic surveillance agency" and its methods cross "legal and ethical lines," the report concludes.

    ICE did not respond to The Register's request for comment.

    Continue reading
  • Fully automated AI networks less than 5 years away, reckons Juniper CEO
    You robot kids, get off my LAN

    AI will completely automate the network within five years, Juniper CEO Rami Rahim boasted during the company’s Global Summit this week.

    “I truly believe that just as there is this need today for a self-driving automobile, the future is around a self-driving network where humans literally have to do nothing,” he said. “It's probably weird for people to hear the CEO of a networking company say that… but that's exactly what we should be wishing for.”

    Rahim believes AI-driven automation is the latest phase in computer networking’s evolution, which began with the rise of TCP/IP and the internet, was accelerated by faster and more efficient silicon, and then made manageable by advances in software.

    Continue reading
  • Pictured: Sagittarius A*, the supermassive black hole at the center of the Milky Way
    We speak to scientists involved in historic first snap – and no, this isn't the M87*

    Astronomers have captured a clear image of the gigantic supermassive black hole at the center of our galaxy for the first time.

    Sagittarius A*, or Sgr A* for short, is 27,000 light-years from Earth. Scientists knew for a while there was a mysterious object in the constellation of Sagittarius emitting strong radio waves, though it wasn't really discovered until the 1970s. Although astronomers managed to characterize some of the object's properties, experts weren't quite sure what exactly they were looking at.

    Years later, in 2020, the Nobel Prize in physics was awarded to a pair of scientists, who mathematically proved the object must be a supermassive black hole. Now, their work has been experimentally verified in the form of the first-ever snap of Sgr A*, captured by more than 300 researchers working across 80 institutions in the Event Horizon Telescope Collaboration. 

    Continue reading
  • Shopping for malware: $260 gets you a password stealer. $90 for a crypto-miner...
    We take a look at low, low subscription prices – not that we want to give anyone any ideas

    A Tor-hidden website dubbed the Eternity Project is offering a toolkit of malware, including ransomware, worms, and – coming soon – distributed denial-of-service programs, at low prices.

    According to researchers at cyber-intelligence outfit Cyble, the Eternity site's operators also have a channel on Telegram, where they provide videos detailing features and functions of the Windows malware. Once bought, it's up to the buyer how victims' computers are infected; we'll leave that to your imagination.

    The Telegram channel has about 500 subscribers, Team Cyble documented this week. Once someone decides to purchase of one or more of Eternity's malware components, they have the option to customize the final binary executable for whatever crimes they want to commit.

    Continue reading
  • Ukrainian crook jailed in US for selling thousands of stolen login credentials
    Touting info on 6,700 compromised systems will get you four years behind bars

    A Ukrainian man has been sentenced to four years in a US federal prison for selling on a dark-web marketplace stolen login credentials for more than 6,700 compromised servers.

    Glib Oleksandr Ivanov-Tolpintsev, 28, was arrested by Polish authorities in Korczowa, Poland, on October 3, 2020, and extradited to America. He pleaded guilty on February 22, and was sentenced on Thursday in a Florida federal district court. The court also ordered Ivanov-Tolpintsev, of Chernivtsi, Ukraine, to forfeit his ill-gotten gains of $82,648 from the credential theft scheme.

    The prosecution's documents [PDF] detail an unnamed, dark-web marketplace on which usernames and passwords along with personal data, including more than 330,000 dates of birth and social security numbers belonging to US residents, were bought and sold illegally.

    Continue reading

Biting the hand that feeds IT © 1998–2022