Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1288388 > unrolled thread

Re: [PATCH] X.509: Fix the time validation [ver #3]

Started byAlexander Holler <holler@ahsoftware.de>
First post2015-12-10 10:30 +0100
Last post2015-12-11 13:40 +0100
Articles 9 — 4 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH] X.509: Fix the time validation [ver #3] Alexander Holler <holler@ahsoftware.de> - 2015-12-10 10:30 +0100
    Re: [PATCH] X.509: Fix the time validation [ver #3] Alexander Holler <holler@ahsoftware.de> - 2015-12-10 16:20 +0100
      Re: [PATCH] X.509: Fix the time validation [ver #3] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-10 16:30 +0100
        Re: [PATCH] X.509: Fix the time validation [ver #3] Alexander Holler <holler@ahsoftware.de> - 2015-12-10 16:40 +0100
          Re: [PATCH] X.509: Fix the time validation [ver #3] Alexander Holler <holler@ahsoftware.de> - 2015-12-10 19:10 +0100
            Re: [PATCH] X.509: Fix the time validation [ver #3] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-10 19:10 +0100
              Re: [PATCH] X.509: Fix the time validation [ver #3] Alexander Holler <holler@ahsoftware.de> - 2015-12-10 19:30 +0100
        Re: [PATCH] X.509: Fix the time validation [ver #3] David Howells <dhowells@redhat.com> - 2015-12-11 12:20 +0100
          Re: [PATCH] X.509: Fix the time validation [ver #3] Josh Boyer <jwboyer@fedoraproject.org> - 2015-12-11 13:40 +0100

#1288388 — Re: [PATCH] X.509: Fix the time validation [ver #3]

FromAlexander Holler <holler@ahsoftware.de>
Date2015-12-10 10:30 +0100
SubjectRe: [PATCH] X.509: Fix the time validation [ver #3]
Message-ID<qE5HY-4fH-9@gated-at.bofh.it>
Am 12.11.2015 um 12:38 schrieb David Howells:
> This fixes CVE-2015-5327.  It affects kernels from 4.3-rc1 onwards.
>
> Fix the X.509 time validation to use month number-1 when looking up the
> number of days in that month.  Also put the month number validation before
> doing the lookup so as not to risk overrunning the array.

I've just run into this with 4.3.1 (mon_len ended up with 0 because of 
the wrong index). Which means currently build stable kernels with 
signature verification might not load modules (depending on which value 
the invalid index mon_len (12) ends up with.

Regards,

Alexander Holler

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1288577

FromAlexander Holler <holler@ahsoftware.de>
Date2015-12-10 16:20 +0100
Message-ID<qEbaG-7V7-23@gated-at.bofh.it>
In reply to#1288388
Am 10.12.2015 um 10:23 schrieb Alexander Holler:
> Am 12.11.2015 um 12:38 schrieb David Howells:
>> This fixes CVE-2015-5327.  It affects kernels from 4.3-rc1 onwards.
>>
>> Fix the X.509 time validation to use month number-1 when looking up the
>> number of days in that month.  Also put the month number validation
>> before
>> doing the lookup so as not to risk overrunning the array.
>
> I've just run into this with 4.3.1 (mon_len ended up with 0 because of
> the wrong index). Which means currently build stable kernels with
> signature verification might not load modules (depending on which value
> the invalid index mon_len (12) ends up with.

Just in case of, I would suggest to quickly push out 4.3.2 (only 4.3 
seems to be affected) which contains at least the patch mentioned in the 
subject (58585c1fc301a36625db41ac7078c4dd0a218d84 in mainline).

Regards,

Alexander Holler
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1288592

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-12-10 16:30 +0100
Message-ID<qEbkl-7Z2-15@gated-at.bofh.it>
In reply to#1288577
On Thu, Dec 10, 2015 at 04:15:22PM +0100, Alexander Holler wrote:
> Am 10.12.2015 um 10:23 schrieb Alexander Holler:
> >Am 12.11.2015 um 12:38 schrieb David Howells:
> >>This fixes CVE-2015-5327.  It affects kernels from 4.3-rc1 onwards.
> >>
> >>Fix the X.509 time validation to use month number-1 when looking up the
> >>number of days in that month.  Also put the month number validation
> >>before
> >>doing the lookup so as not to risk overrunning the array.
> >
> >I've just run into this with 4.3.1 (mon_len ended up with 0 because of
> >the wrong index). Which means currently build stable kernels with
> >signature verification might not load modules (depending on which value
> >the invalid index mon_len (12) ends up with.
> 
> Just in case of, I would suggest to quickly push out 4.3.2 (only 4.3 seems
> to be affected) which contains at least the patch mentioned in the subject
> (58585c1fc301a36625db41ac7078c4dd0a218d84 in mainline).

58585c1fc301a36625db41ac7078c4dd0a218d84 doesn't reference anything in
Linus's tree, where did you get that git commit id?

David, any reason you didn't put a cc: stable in the commit for it to be
picked up in the stable releases?

thanks,

greg k-h

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1288609

FromAlexander Holler <holler@ahsoftware.de>
Date2015-12-10 16:40 +0100
Message-ID<qEbu2-83j-25@gated-at.bofh.it>
In reply to#1288592
Am 10.12.2015 um 16:26 schrieb Greg Kroah-Hartman:
> On Thu, Dec 10, 2015 at 04:15:22PM +0100, Alexander Holler wrote:

>> Just in case of, I would suggest to quickly push out 4.3.2 (only 4.3 seems
>> to be affected) which contains at least the patch mentioned in the subject
>> (58585c1fc301a36625db41ac7078c4dd0a218d84 in mainline).
>
> 58585c1fc301a36625db41ac7078c4dd0a218d84 doesn't reference anything in
> Linus's tree, where did you get that git commit id?

Uh, hmm, maybe I've picked the wrong commit number when I've used git 
gui blame to find the original commit. Might have been one from my own 
trees which are based on mainline. Sorry, having had a second look, the 
one I've cherry-picked from mainline was 
cc25b994acfbc901429da682d0f73c190e960206

Regards,

Alexander Holler
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1288761

FromAlexander Holler <holler@ahsoftware.de>
Date2015-12-10 19:10 +0100
Message-ID<qEdPb-1ez-1@gated-at.bofh.it>
In reply to#1288609
Am 10.12.2015 um 16:34 schrieb Alexander Holler:
> Am 10.12.2015 um 16:26 schrieb Greg Kroah-Hartman:
>> On Thu, Dec 10, 2015 at 04:15:22PM +0100, Alexander Holler wrote:
>
>>> Just in case of, I would suggest to quickly push out 4.3.2 (only 4.3
>>> seems
>>> to be affected) which contains at least the patch mentioned in the
>>> subject
>>> (58585c1fc301a36625db41ac7078c4dd0a218d84 in mainline).
>>
>> 58585c1fc301a36625db41ac7078c4dd0a218d84 doesn't reference anything in
>> Linus's tree, where did you get that git commit id?
>
> Uh, hmm, maybe I've picked the wrong commit number when I've used git
> gui blame to find the original commit. Might have been one from my own
> trees which are based on mainline. Sorry, having had a second look, the
> one I've cherry-picked from mainline was
> cc25b994acfbc901429da682d0f73c190e960206

To give my motivation for that mail (and that "quickly"): it's highly 
annoying to end up with a box which does not have network and, as in my 
case, even without working input devices because modules weren't loaded. 
And other people don't might be able to find the problem (and existing 
patch) as quick as I did and might end up even more annoyed than I was 
for a short period of time. ;)

> Regards,
>
> Alexander Holler

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1288768

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2015-12-10 19:10 +0100
Message-ID<qEdPd-1ez-21@gated-at.bofh.it>
In reply to#1288761
On Thu, Dec 10, 2015 at 07:00:46PM +0100, Alexander Holler wrote:
> Am 10.12.2015 um 16:34 schrieb Alexander Holler:
> >Am 10.12.2015 um 16:26 schrieb Greg Kroah-Hartman:
> >>On Thu, Dec 10, 2015 at 04:15:22PM +0100, Alexander Holler wrote:
> >
> >>>Just in case of, I would suggest to quickly push out 4.3.2 (only 4.3
> >>>seems
> >>>to be affected) which contains at least the patch mentioned in the
> >>>subject
> >>>(58585c1fc301a36625db41ac7078c4dd0a218d84 in mainline).
> >>
> >>58585c1fc301a36625db41ac7078c4dd0a218d84 doesn't reference anything in
> >>Linus's tree, where did you get that git commit id?
> >
> >Uh, hmm, maybe I've picked the wrong commit number when I've used git
> >gui blame to find the original commit. Might have been one from my own
> >trees which are based on mainline. Sorry, having had a second look, the
> >one I've cherry-picked from mainline was
> >cc25b994acfbc901429da682d0f73c190e960206
> 
> To give my motivation for that mail (and that "quickly"): it's highly
> annoying to end up with a box which does not have network and, as in my
> case, even without working input devices because modules weren't loaded. And
> other people don't might be able to find the problem (and existing patch) as
> quick as I did and might end up even more annoyed than I was for a short
> period of time. ;)

We already have one other report of this problem hitting them.  I've now
released 4.3.2-rc1, with a "quick" review period of 24 hours before I
release 4.3.2 with just this fix.  If you could verify I didn't mess
anything up I would appreciate it.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1288793

FromAlexander Holler <holler@ahsoftware.de>
Date2015-12-10 19:30 +0100
Message-ID<qEe8y-1lV-23@gated-at.bofh.it>
In reply to#1288768
Am 10.12.2015 um 19:09 schrieb Greg Kroah-Hartman:

> We already have one other report of this problem hitting them.  I've now
> released 4.3.2-rc1, with a "quick" review period of 24 hours before I
> release 4.3.2 with just this fix.  If you could verify I didn't mess
> anything up I would appreciate it.

After applying those two patches from 4.3.2-rc1 you've posted instead of 
the one I've cherry-picked, git diff ended up with no difference to the 
source of the kernel I'm currently running. Reading those two patches 
also looks good.

Thanks a lot.

Alexander Holler

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1289430

FromDavid Howells <dhowells@redhat.com>
Date2015-12-11 12:20 +0100
Message-ID<qEtTX-3va-1@gated-at.bofh.it>
In reply to#1288592
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:

> David, any reason you didn't put a cc: stable in the commit for it to be
> picked up in the stable releases?

I did cc it to stable.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1289524

FromJosh Boyer <jwboyer@fedoraproject.org>
Date2015-12-11 13:40 +0100
Message-ID<qEv9o-4hC-29@gated-at.bofh.it>
In reply to#1289430
On Fri, Dec 11, 2015 at 6:13 AM, David Howells <dhowells@redhat.com> wrote:
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
>> David, any reason you didn't put a cc: stable in the commit for it to be
>> picked up in the stable releases?
>
> I did cc it to stable.

You had the stable list in the CC field when you sent the patch, but
the CC: stable@vger.kernel.org tag is missing in the commit body.
Greg's scripts key off the later.  Just cc'ing the list when you send
the email does nothing.

FWIW, I asked James if it should have been CC'd to stable when he sent
the pull request to Linus and I never got a reply.

josh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web