From 6d0ee56813d69eee72108e1dc859743e02f70077 Mon Sep 17 00:00:00 2001 From: Josh Holtrop Date: Thu, 5 Jun 2025 19:48:34 -0400 Subject: [PATCH] Reseed DRBG in RAND_poll() CVE: CVE-2025-7394 Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/0c12337194ee6dd082f082f0ccaed27fc4ee44f5] (cherry picked from commit 0c12337194ee6dd082f082f0ccaed27fc4ee44f5) Signed-off-by: Ankur Tyagi --- src/ssl.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/src/ssl.c b/src/ssl.c index 9ba891d62..a1421d523 100644 --- a/src/ssl.c +++ b/src/ssl.c @@ -24159,11 +24159,25 @@ int wolfSSL_RAND_poll(void) return WOLFSSL_FAILURE; } ret = wc_GenerateSeed(&globalRNG.seed, entropy, entropy_sz); - if (ret != 0){ + if (ret != 0) { WOLFSSL_MSG("Bad wc_RNG_GenerateBlock"); ret = WOLFSSL_FAILURE; - }else - ret = WOLFSSL_SUCCESS; + } + else { +#ifdef HAVE_HASHDRBG + ret = wc_RNG_DRBG_Reseed(&globalRNG, entropy, entropy_sz); + if (ret != 0) { + WOLFSSL_MSG("Error reseeding DRBG"); + ret = WOLFSSL_FAILURE; + } + else { + ret = WOLFSSL_SUCCESS; + } +#else + WOLFSSL_MSG("RAND_poll called with HAVE_HASHDRBG not set"); + ret = WOLFSSL_FAILURE; +#endif + } return ret; }