Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1608439

Re: [PATCH] crypto: xts,lrw - fix out-of-bounds write after kmalloc failure

Show all headers | View raw

On Thu, Mar 23, 2017 at 01:39:46PM -0700, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
> 
> In the generic XTS and LRW algorithms, for input data > 128 bytes, a
> temporary buffer is allocated to hold the values to be XOR'ed with the
> data before and after encryption or decryption.  If the allocation
> fails, the fixed-size buffer embedded in the request buffer is meant to
> be used as a fallback --- resulting in more calls to the ECB algorithm,
> but still producing the correct result.  However, we weren't correctly
> limiting subreq->cryptlen in this case, resulting in pre_crypt()
> overrunning the embedded buffer.  Fix this by setting subreq->cryptlen
> correctly.
> 
> Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher")
> Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher")
> Cc: stable@vger.kernel.org # v4.10+
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Signed-off-by: Eric Biggers <ebiggers@google.com>

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

crypto: out-of-bounds write in pre_crypt Dmitry Vyukov <dvyukov@google.com> - 2017-03-23 12:00 +0100
  Re: crypto: out-of-bounds write in pre_crypt Eric Biggers <ebiggers3@gmail.com> - 2017-03-23 21:40 +0100
  [PATCH] crypto: xts,lrw - fix out-of-bounds write after kmalloc failure Eric Biggers <ebiggers3@gmail.com> - 2017-03-23 21:50 +0100
    Re: [PATCH] crypto: xts,lrw - fix out-of-bounds write after  kmalloc failure David Miller <davem@davemloft.net> - 2017-03-23 22:10 +0100
    Re: [PATCH] crypto: xts,lrw - fix out-of-bounds write after kmalloc  failure Herbert Xu <herbert@gondor.apana.org.au> - 2017-03-24 15:20 +0100

csiph-web