linux-kernel - Re: [PATCH 1/1] KEYS: encrypted: fix buffer overread in valid_master

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180206015435.GA91829@google.com>
Date:   Mon, 5 Feb 2018 17:54:35 -0800
From:   Eric Biggers <ebiggers@...gle.com>
To:     Jin Qian <jinqian@...roid.com>
Cc:     Mimi Zohar <zohar@...ux.vnet.ibm.com>,
        David Safford <safford@...ibm.com>,
        David Howells <dhowells@...hat.com>,
        James Morris <james.l.morris@...cle.com>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        linux-security-module@...r.kernel.org, keyrings@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH 1/1] KEYS: encrypted: fix buffer overread in
 valid_master_desc()

On Mon, Feb 05, 2018 at 12:02:46PM -0800, Jin Qian wrote:
> From: Eric Biggers <ebiggers@...gle.com>
> 
> commit 794b4bc292f5d31739d89c0202c54e7dc9bc3add upstream
> 
> With the 'encrypted' key type it was possible for userspace to provide a
> data blob ending with a master key description shorter than expected,
> e.g. 'keyctl add encrypted desc "new x" @s'.  When validating such a
> master key description, validate_master_desc() could read beyond the end
> of the buffer.  Fix this by using strncmp() instead of memcmp().  [Also
> clean up the code to deduplicate some logic.]
> 
> Cc: stable@...r.kernel.org
> Cc: Mimi Zohar <zohar@...ux.vnet.ibm.com>
> Signed-off-by: Eric Biggers <ebiggers@...gle.com>
> Signed-off-by: David Howells <dhowells@...hat.com>
> Signed-off-by: James Morris <james.l.morris@...cle.com>
> Signed-off-by: Jin Qian <jinqian@...roid.com>
> ---
>  security/keys/encrypted-keys/encrypted.c | 31 +++++++++++++++----------------
>  1 file changed, 15 insertions(+), 16 deletions(-)
> 

Hi Jin, see Documentation/stable_kernel_rules.txt -- patches for stable should
be sent To: stable@...r.kernel.org (and generally with a lighter Cc: list,
unless it's a complicated backport), and you need to say which kernel version(s)
it should be applied to.  Also for upstream commits that cherry-pick cleanly,
such as this one, you don't need to send an actual patch but rather just request
that it be applied.  The reason it should be applied is helpful too; in this
case the commit fixes a bug that caused a KASAN warning.

Thanks!

- Eric