Use a SafeHandle when duplicating a certificate context. #119362
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CertDuplicateCertificateContext does not ensure the CERT_CONTEXT pointer it is incrementing has not been freed. If the duplicate and dispose race, duplicating a disposed handle will lead to unspecified behavior. For .NET 10, we can use the SafeHandle around the certificate before we duplicate the handle. For OOB, we don't have access to the internals, so we will continue to use the IntPtr Handle property.
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR addresses a race condition in certificate context duplication by using SafeHandle to ensure thread safety. The changes prevent potential crashes when CertDuplicateCertificateContext is called on a certificate handle that has been freed.
- Uses SafeHandle for certificate context duplication instead of raw IntPtr
- Implements conditional compilation to support both .NET 10 (with SafeHandle access) and OOB packages (with IntPtr fallback)
- Adds proper reference counting around the duplication operation to prevent use-after-free
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| CertificatePal.Windows.cs | Adds SafeHandle property to expose the internal certificate context handle |
| System.Security.Cryptography CertificateHelpers.Windows.cs | Implements SafeHandle-based certificate duplication with proper reference counting |
| Microsoft.Bcl.Cryptography CertificateHelpers.Windows.cs | Provides fallback implementation using IntPtr for OOB packages |
| Common CertificateHelpers.Windows.cs | Adds partial method declaration and updates GetPrivateKey to use new duplication method |
...Cryptography/src/System/Security/Cryptography/X509Certificates/CertificateHelpers.Windows.cs
Show resolved
Hide resolved
Contributor
|
Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones |
bartonjs
approved these changes
Sep 4, 2025
Member
Author
|
/backport to release/10.0 |
Contributor
|
Started backporting to release/10.0: https://github.com/dotnet/runtime/actions/runs/17477676496 |
4 tasks
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CertDuplicateCertificateContext does not ensure the CERT_CONTEXT pointer it is incrementing has not been freed. If the duplicate and dispose race, duplicating a disposed handle will lead to unspecified behavior.
For .NET 10, we can use the SafeHandle around the certificate before we duplicate the handle. For OOB, we don't have access to the internals, so we will continue to use the IntPtr Handle property.
Contributes to #119313