Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1661293

[PATCH 08/23] KEYS: encrypted: fix buffer overread in valid_master_desc()

Show all headers | View raw

From: Eric Biggers <ebiggers@google.com>

With the 'encrypted' key type it was possible for userspace to provide a
data blob ending with a master key description shorter than expected,
e.g. 'keyctl add encrypted desc "new x" @s'.  When validating such a
master key description, validate_master_desc() could read beyond the end
of the buffer.  Fix this by using strncmp() instead of memcmp().  [Also
clean up the code to deduplicate some logic.]

Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---

 security/keys/encrypted-keys/encrypted.c |   31 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index d14f1a47a130..0f7b95de3b5f 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -141,23 +141,22 @@ static int valid_ecryptfs_desc(const char *ecryptfs_desc)
  */
 static int valid_master_desc(const char *new_desc, const char *orig_desc)
 {
-	if (!memcmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) {
-		if (strlen(new_desc) == KEY_TRUSTED_PREFIX_LEN)
-			goto out;
-		if (orig_desc)
-			if (memcmp(new_desc, orig_desc, KEY_TRUSTED_PREFIX_LEN))
-				goto out;
-	} else if (!memcmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) {
-		if (strlen(new_desc) == KEY_USER_PREFIX_LEN)
-			goto out;
-		if (orig_desc)
-			if (memcmp(new_desc, orig_desc, KEY_USER_PREFIX_LEN))
-				goto out;
-	} else
-		goto out;
+	int prefix_len;
+
+	if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
+		prefix_len = KEY_TRUSTED_PREFIX_LEN;
+	else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
+		prefix_len = KEY_USER_PREFIX_LEN;
+	else
+		return -EINVAL;
+
+	if (!new_desc[prefix_len])
+		return -EINVAL;
+
+	if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
+		return -EINVAL;
+
 	return 0;
-out:
-	return -EINVAL;
 }
 
 /*

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/23] KEYS: Fixes David Howells <dhowells@redhat.com> - 2017-06-08 15:50 +0200
  [PATCH 05/23] KEYS: Delete an error message for a failed memory  allocation in get_derived_key() David Howells <dhowells@redhat.com> - 2017-06-08 15:50 +0200
  [PATCH 18/23] KEYS: DH: forbid using digest_null as the KDF hash David Howells <dhowells@redhat.com> - 2017-06-08 15:50 +0200
  [PATCH 10/23] KEYS: encrypted: use constant-time HMAC comparison David Howells <dhowells@redhat.com> - 2017-06-08 15:50 +0200
  [PATCH 04/23] X.509: Fix error code in x509_cert_parse() David Howells <dhowells@redhat.com> - 2017-06-08 15:50 +0200
  [PATCH 07/23] KEYS: encrypted: avoid encrypting/decrypting stack  buffers David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 20/23] KEYS: DH: ensure the KDF counter is properly aligned David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 19/23] KEYS: DH: don't feed uninitialized "otherinfo" into  KDF David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 16/23] KEYS: trusted: sanitize all key material David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 21/23] KEYS: DH: add __user annotations to keyctl_kdf_params David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 13/23] KEYS: sanitize add_key() and keyctl() key payloads David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 14/23] KEYS: user_defined: sanitize key payloads David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 22/23] crypto : asymmetric_keys : verify_pefile:zero memory  content before freeing David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 23/23] KEYS: Convert KEYCTL_DH_COMPUTE to use the crypto KPP  API David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 11/23] KEYS: fix dereferencing NULL payload with nonzero  length David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 09/23] KEYS: encrypted: fix race causing incorrect HMAC  calculations David Howells <dhowells@redhat.com> - 2017-06-08 16:00 +0200
  [PATCH 08/23] KEYS: encrypted: fix buffer overread in  valid_master_desc() David Howells <dhowells@redhat.com> - 2017-06-08 16:10 +0200
  [PATCH 02/23] security: use READ_ONCE instead of deprecated  ACCESS_ONCE David Howells <dhowells@redhat.com> - 2017-06-08 16:10 +0200
  Re: [PATCH 00/23] KEYS: Fixes James Morris <jmorris@namei.org> - 2017-06-08 16:40 +0200
    Re: [PATCH 00/23] KEYS: Fixes David Howells <dhowells@redhat.com> - 2017-06-08 16:50 +0200

csiph-web