dev-libs/openssl: Add fix for CVE-2023-1255.
BUG=b/280544347
TEST=presubmit,validation
RELEASE_NOTE=Fixed CVE-2023-1255 in the dev-libs/openssl package.
Change-Id: I81033cd58f93c7c7d06cf5e7b71f0942ce4316f7
Reviewed-on: https://cos-review.googlesource.com/c/third_party/overlays/chromiumos-overlay/+/49476
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
diff --git a/dev-libs/openssl/files/openssl-CVE-2023-1255-fix.patch b/dev-libs/openssl/files/openssl-CVE-2023-1255-fix.patch
new file mode 100644
index 0000000..022aa7d
--- /dev/null
+++ b/dev-libs/openssl/files/openssl-CVE-2023-1255-fix.patch
@@ -0,0 +1,45 @@
+From 02ac9c9420275868472f33b01def01218742b8bb Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tomas@openssl.org>
+Date: Mon, 17 Apr 2023 16:51:20 +0200
+Subject: [PATCH] aesv8-armx.pl: Avoid buffer overrread in AES-XTS decryption
+
+Original author: Nevine Ebeid (Amazon)
+Fixes: CVE-2023-1255
+
+The buffer overread happens on decrypts of 4 mod 5 sizes.
+Unless the memory just after the buffer is unmapped this is harmless.
+
+Reviewed-by: Paul Dale <pauli@openssl.org>
+Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
+(Merged from https://github.com/openssl/openssl/pull/20759)
+
+(cherry picked from commit 72dfe46550ee1f1bbfacd49f071419365bc23304)
+---
+ crypto/aes/asm/aesv8-armx.pl | 4 +++-
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/aes/asm/aesv8-armx.pl b/crypto/aes/asm/aesv8-armx.pl
+index 6a7bf05d1b..bd583e2c89 100755
+--- a/crypto/aes/asm/aesv8-armx.pl
++++ b/crypto/aes/asm/aesv8-armx.pl
+@@ -3353,7 +3353,7 @@ $code.=<<___ if ($flavour =~ /64/);
+ .align 4
+ .Lxts_dec_tail4x:
+ add $inp,$inp,#16
+- vld1.32 {$dat0},[$inp],#16
++ tst $tailcnt,#0xf
+ veor $tmp1,$dat1,$tmp0
+ vst1.8 {$tmp1},[$out],#16
+ veor $tmp2,$dat2,$tmp2
+@@ -3362,6 +3362,8 @@ $code.=<<___ if ($flavour =~ /64/);
+ veor $tmp4,$dat4,$tmp4
+ vst1.8 {$tmp3-$tmp4},[$out],#32
+
++ b.eq .Lxts_dec_abort
++ vld1.32 {$dat0},[$inp],#16
+ b .Lxts_done
+ .align 4
+ .Lxts_outer_dec_tail:
+--
+2.34.1
+
diff --git a/dev-libs/openssl/openssl-3.0.8-r1.ebuild b/dev-libs/openssl/openssl-3.0.8-r1.ebuild
new file mode 120000
index 0000000..ce2d971
--- /dev/null
+++ b/dev-libs/openssl/openssl-3.0.8-r1.ebuild
@@ -0,0 +1 @@
+openssl-3.0.8.ebuild
\ No newline at end of file
diff --git a/dev-libs/openssl/openssl-3.0.8.ebuild b/dev-libs/openssl/openssl-3.0.8.ebuild
index 0a8f8b8..1a37bc0 100644
--- a/dev-libs/openssl/openssl-3.0.8.ebuild
+++ b/dev-libs/openssl/openssl-3.0.8.ebuild
@@ -56,6 +56,7 @@
"${FILESDIR}"/openssl-CVE-2023-0464-fix.patch
"${FILESDIR}"/openssl-CVE-2023-0465-fix.patch
"${FILESDIR}"/openssl-CVE-2023-0466-fix.patch
+ "${FILESDIR}"/openssl-CVE-2023-1255-fix.patch
)
pkg_setup() {
