Mitigate timing oracle using dummy hash cache - #1116
Conversation
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
6be2e53 to
49470f2
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
49470f2 to
f1ec2b3
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
f1ec2b3 to
4c429fa
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
No new issues found in the changed files. ✅
4c429fa to
101b87a
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
No new issues found in the changed files. ✅
101b87a to
be56e50
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
be56e50 to
568fea0
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
568fea0 to
b1ea836
Compare
b1ea836 to
dc37d33
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1116
Scan targets checked: wolfssh-bugs, wolfssh-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Findings are non-blocking.
| rootShadow = getspnam("root"); | ||
| if (rootShadow != NULL && rootShadow->sp_pwdp != NULL) { | ||
| GetFakeHashFromTemplate(rootShadow->sp_pwdp, cachedFakeHashes[0], sizeof(cachedFakeHashes[0])); | ||
| numCachedFakeHashes = 1; |
There was a problem hiding this comment.
🔵 [Low] Root-fallback fake-hash caching skips template-validity check, masking degraded-mode warning · Incorrect error handling
The /etc/shadow scan validates tmpl[1] != '\0' && tmpl[1] != '*' before counting a cached hash, but the getspnam("root") fallback sets numCachedFakeHashes = 1 unconditionally, even when GetFakeHashFromTemplate returns the degenerate "!" placeholder (root locked with ! or !$...).
Fix: Apply the same tmpl[1] != '\0' && tmpl[1] != '*' validity check used in the shadow-scan loop before setting numCachedFakeHashes = 1.
3 participants
Does a fake crypt() operation when an authentication attempt is rejected early and caches hash type at SSHD startup. CI testing is added for this change.