mirror of
https://github.com/open62541/open62541.git
synced 2026-10-29 05:11:36 +08:00
Niels Beier
1c1cbbdf8a
The OpenSSL HMAC-SHA1/SHA256 verify helpers compared the recomputed MAC against the peer-supplied signature with UA_ByteString_equal(), which reduces to a plain memcmp(). memcmp() carries no constant-time guarantee and, on a byte-at-a-time implementation (the norm on the small-footprint libcs open62541 is routinely built against), returns as soon as it finds a differing byte -- a timing side channel a remote peer can use to recover a valid MAC byte-by-byte. Switch to UA_constantTimeEqual(), already used correctly by every other symmetric SecurityPolicy (mbedTLS Basic128Rsa15, Basic256, Basic256Sha256, Aes128Sha256RsaOaep). Since it takes a single length and reads that many bytes from both buffers, first validate signature->length against the expected MAC length, mirroring the pattern used by the project's mbedTLS RSA policy Verify functions. The digest length is fixed by the algorithm and policy, not attacker data, so this early-return introduces no new timing side channel. Internal Vulnerability Advisory: open62541-SA-2026-0038 Co-authored-by: Luigi Colluto <gigioneggiando@users.noreply.github.com>