linux-kernel - Re: [PATCH 4.5 079/238] crypto: ccp - Dont assume export/import areas are aligned

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1460481936.2705.1.camel@decadent.org.uk>
Date:	Tue, 12 Apr 2016 18:25:36 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Tom Lendacky <thomas.lendacky@....com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Herbert Xu <herbert@...dor.apana.org.au>
Subject: Re: [PATCH 4.5 079/238] crypto: ccp - Dont assume export/import
 areas are aligned

On Tue, 2016-04-12 at 12:01 -0500, Tom Lendacky wrote:
> On 04/12/2016 09:28 AM, Greg Kroah-Hartman wrote:
> > 
> > On Tue, Apr 12, 2016 at 02:56:52AM +0100, Ben Hutchings wrote:
> > > 
> > > On Sun, 2016-04-10 at 11:34 -0700, Greg Kroah-Hartman wrote:
[...]
> > > > -	state->type = rctx->type;
> > > > -	state->msg_bits = rctx->msg_bits;
> > > > -	state->first = rctx->first;
> > > > -	memcpy(state->ctx, rctx->ctx, sizeof(state->ctx));
> > > > -	state->buf_count = rctx->buf_count;
> > > > -	memcpy(state->buf, rctx->buf, sizeof(state->buf));
> > > > +	state.type = rctx->type;
> > > > +	state.msg_bits = rctx->msg_bits;
> > > > +	state.first = rctx->first;
> > > > +	memcpy(state.ctx, rctx->ctx, sizeof(state.ctx));
> > > > +	state.buf_count = rctx->buf_count;
> > > > +	memcpy(state.buf, rctx->buf, sizeof(state.buf));
> > > > +
> > > > +	/* 'out' may not be aligned so memcpy from local variable */
> > > > +	memcpy(out, &state, sizeof(state));
> > > [...]
> > > 
> > > The padding was not initialised, but here we copy it to userland.
> > Nice catch.  Given that the user/kernel structure here doesn't seem very
> > sane (implicit padding, etc.), shouldn't that be where this is fixed up
> > to be a properly packed structure?  Or have padding where needed, along
> > with a memset() call?
> The structure is not meant for use outside the kernel - it's an opaque
> blob that will be processed by the driver import function. So would it
> be enough to just memset the struct ccp_sha_exp_ctx state variable to 0
> before setting and copying it?  That should take care of any padding not
> being initialized.

I think that would be enough.

Ben.

-- 
Ben Hutchings
This sentence contradicts itself - no actually it doesn't.
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)