Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1628050

[PATCH 1/5] KEYS: sanitize add_key() and keyctl() key payloads

Show all headers | View raw

From: Eric Biggers <ebiggers@google.com>

Before returning from add_key() or one of the keyctl() commands that
takes in a key payload, zero the temporary buffer that was allocated to
hold the key payload copied from userspace.  This may contain sensitive
key material that should not be kept around in the slab caches.

This must not be applied before the patch "KEYS: fix dereferencing NULL
payload with nonzero length".

Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 security/keys/keyctl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 10fcea154c0f..d2852621e358 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -137,6 +137,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
 
 	key_ref_put(keyring_ref);
  error3:
+	memzero_explicit(payload, plen);
 	kvfree(payload);
  error2:
 	kfree(description);
@@ -347,7 +348,7 @@ long keyctl_update_key(key_serial_t id,
 
 	key_ref_put(key_ref);
 error2:
-	kfree(payload);
+	kzfree(payload);
 error:
 	return ret;
 }
@@ -1098,6 +1099,7 @@ long keyctl_instantiate_key_common(key_serial_t id,
 		keyctl_change_reqkey_auth(NULL);
 
 error2:
+	memzero_explicit(payload, plen);
 	kvfree(payload);
 error:
 	return ret;
-- 
2.12.2

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/5] KEYS: sanitize key payloads Eric Biggers <ebiggers3@gmail.com> - 2017-04-21 10:40 +0200
  [PATCH 1/5] KEYS: sanitize add_key() and keyctl() key payloads Eric Biggers <ebiggers3@gmail.com> - 2017-04-21 10:40 +0200
  [PATCH 4/5] KEYS: trusted: sanitize all key material Eric Biggers <ebiggers3@gmail.com> - 2017-04-21 10:40 +0200
  [PATCH 2/5] KEYS: user_defined: sanitize key payloads Eric Biggers <ebiggers3@gmail.com> - 2017-04-21 10:40 +0200
    Re: [PATCH 2/5] KEYS: user_defined: sanitize key payloads David Howells <dhowells@redhat.com> - 2017-04-21 16:00 +0200
      Re: [PATCH 2/5] KEYS: user_defined: sanitize key payloads Eric Biggers <ebiggers3@gmail.com> - 2017-04-21 20:40 +0200
        Re: [PATCH 2/5] KEYS: user_defined: sanitize key payloads David Howells <dhowells@redhat.com> - 2017-04-24 16:20 +0200

csiph-web