linux-kernel - Re: crypto: out-of-bounds write in pre

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170323203921.GB92809@gmail.com>
Date:   Thu, 23 Mar 2017 13:39:21 -0700
From:   Eric Biggers <ebiggers3@...il.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Herbert Xu <herbert@...dor.apana.org.au>,
        David Miller <davem@...emloft.net>,
        linux-crypto@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: crypto: out-of-bounds write in pre_crypt

Hi Dmitry,

On Thu, Mar 23, 2017 at 11:51:30AM +0100, Dmitry Vyukov wrote:
> Hello,
> 
> I've got the following report while running syzkaller fuzzer.
> init_crypt ignores kmalloc failure, which later leads to out-of-bounds
> writes in ptr_crypt. On commit
> 093b995e3b55a0ae0670226ddfcb05bfbf0099ae.
> 

Thanks for finding this!  Nice to see that the crypto code is getting tested...

This bug was introduced in v4.10 and affects the generic XTS and LRW drivers.
They are supposed to work in the event of a kmalloc failure, but evidently it's
broken.  I'm sending a patch shortly.

- Eric