linux-kernel - Re: [PATCH] crypto: ccm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d43b27ea-17ce-57ec-86d8-449110283374@microchip.com>
Date:   Thu, 2 Nov 2017 16:03:24 +0200
From:   Tudor Ambarus <tudor.ambarus@...rochip.com>
To:     Romain Izard <romain.izard.pro@...il.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S . Miller" <davem@...emloft.net>
CC:     <linux-crypto@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] crypto: ccm - preserve the IV buffer


On 10/31/2017 04:42 PM, Romain Izard wrote:
> The IV buffer used during CCM operations is used twice, during both the
> hashing step and the ciphering step.
> 
> When using a hardware accelerator that updates the contents of the IV
> buffer at the end of ciphering operations, the value will be modified.
> In the decryption case, the subsequent setup of the hashing algorithm
> will interpret the updated IV instead of the original value, which can
> lead to out-of-bounds writes.
> 
> Reuse the idata buffer, only used in the hashing step, to preserve the
> IV's value during the ciphering step in the decryption case.
> 
> Signed-off-by: Romain Izard <romain.izard.pro@...il.com>
> ---
>   crypto/ccm.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/crypto/ccm.c b/crypto/ccm.c
> index 1ce37ae0ce56..0a083342ec8c 100644
> --- a/crypto/ccm.c
> +++ b/crypto/ccm.c
> @@ -363,7 +363,7 @@ static int crypto_ccm_decrypt(struct aead_request *req)
>   	unsigned int cryptlen = req->cryptlen;
>   	u8 *authtag = pctx->auth_tag;
>   	u8 *odata = pctx->odata;
> -	u8 *iv = req->iv;
> +	u8 *iv = pctx->idata;
>   	int err;
>   
>   	cryptlen -= authsize;
> @@ -379,6 +379,8 @@ static int crypto_ccm_decrypt(struct aead_request *req)
>   	if (req->src != req->dst)
>   		dst = pctx->dst;
>   
> +	memcpy(iv, req->iv, 16);
> +
>   	skcipher_request_set_tfm(skreq, ctx->ctr);
>   	skcipher_request_set_callback(skreq, pctx->flags,
>   				      crypto_ccm_decrypt_done, req);
> 

Reviewed-by: Tudor Ambarus <tudor.ambarus@...rochip.com>