From: Tom Lane <tgl@sss.pgh.pa.us>
Date: Wed, 27 Mar 2013 22:50:21 +0000 (-0400)
Subject: Reset OpenSSL randomness state in each postmaster child process.
X-Git-Tag: REL9_3_BETA1~167
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0d1ecd6300191a450978ca2fcd12bbbb7c5e65e6;p=postgresql

Reset OpenSSL randomness state in each postmaster child process.

Previously, if the postmaster initialized OpenSSL's PRNG (which it will do
when ssl=on in postgresql.conf), the same pseudo-random state would be
inherited by each forked child process.  The problem is masked to a
considerable extent if the incoming connection uses SSL encryption, but
when it does not, identical pseudo-random state is made available to
functions like contrib/pgcrypto.  The process's PID does get mixed into any
requested random output, but on most systems that still only results in 32K
or so distinct random sequences available across all Postgres sessions.
This might allow an attacker who has database access to guess the results
of "secure" operations happening in another session.

To fix, forcibly reset the PRNG after fork().  Each child process that has
need for random numbers from OpenSSL's generator will thereby be forced to
go through OpenSSL's normal initialization sequence, which should provide
much greater variability of the sequences.  There are other ways we might
do this that would be slightly cheaper, but this approach seems the most
future-proof against SSL-related code changes.

This has been assigned CVE-2013-1900, but since the issue and the patch
have already been publicized on pgsql-hackers, there's no point in trying
to hide this commit.

Back-patch to all supported branches.

Marko Kreen
---

diff --git a/src/backend/postmaster/fork_process.c b/src/backend/postmaster/fork_process.c
index 827b0b2fa6..2d1e75613d 100644
--- a/src/backend/postmaster/fork_process.c
+++ b/src/backend/postmaster/fork_process.c
@@ -17,6 +17,9 @@
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <unistd.h>
+#ifdef USE_SSL
+#include <openssl/rand.h>
+#endif
 
 #ifndef WIN32
 /*
@@ -124,6 +127,13 @@ fork_process(void)
 			}
 		}
 #endif   /* LINUX_OOM_ADJ */
+
+		/*
+		 * Make sure processes do not share OpenSSL randomness state.
+		 */
+#ifdef USE_SSL
+		RAND_cleanup();
+#endif
 	}
 
 	return result;