lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 2 Nov 2017 16:03:24 +0200 From: Tudor Ambarus <tudor.ambarus@...rochip.com> To: Romain Izard <romain.izard.pro@...il.com>, Herbert Xu <herbert@...dor.apana.org.au>, "David S . Miller" <davem@...emloft.net> CC: <linux-crypto@...r.kernel.org>, <linux-kernel@...r.kernel.org> Subject: Re: [PATCH] crypto: ccm - preserve the IV buffer On 10/31/2017 04:42 PM, Romain Izard wrote: > The IV buffer used during CCM operations is used twice, during both the > hashing step and the ciphering step. > > When using a hardware accelerator that updates the contents of the IV > buffer at the end of ciphering operations, the value will be modified. > In the decryption case, the subsequent setup of the hashing algorithm > will interpret the updated IV instead of the original value, which can > lead to out-of-bounds writes. > > Reuse the idata buffer, only used in the hashing step, to preserve the > IV's value during the ciphering step in the decryption case. > > Signed-off-by: Romain Izard <romain.izard.pro@...il.com> > --- > crypto/ccm.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/crypto/ccm.c b/crypto/ccm.c > index 1ce37ae0ce56..0a083342ec8c 100644 > --- a/crypto/ccm.c > +++ b/crypto/ccm.c > @@ -363,7 +363,7 @@ static int crypto_ccm_decrypt(struct aead_request *req) > unsigned int cryptlen = req->cryptlen; > u8 *authtag = pctx->auth_tag; > u8 *odata = pctx->odata; > - u8 *iv = req->iv; > + u8 *iv = pctx->idata; > int err; > > cryptlen -= authsize; > @@ -379,6 +379,8 @@ static int crypto_ccm_decrypt(struct aead_request *req) > if (req->src != req->dst) > dst = pctx->dst; > > + memcpy(iv, req->iv, 16); > + > skcipher_request_set_tfm(skreq, ctx->ctr); > skcipher_request_set_callback(skreq, pctx->flags, > crypto_ccm_decrypt_done, req); > Reviewed-by: Tudor Ambarus <tudor.ambarus@...rochip.com>
Powered by blists - more mailing lists