lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 25 Aug 2020 22:18:42 +0200 From: Maximilian Luz <luzmaximilian@...il.com> To: Brian Norris <briannorris@...omium.org> Cc: Amitkumar Karwar <amitkarwar@...il.com>, Ganapathi Bhat <ganapathi.bhat@....com>, Xinming Hu <huxinming820@...il.com>, Kalle Valo <kvalo@...eaurora.org>, "David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Dan Carpenter <dan.carpenter@...cle.com>, linux-wireless <linux-wireless@...r.kernel.org>, netdev@...r.kernel.org, Linux Kernel <linux-kernel@...r.kernel.org>, Kaloyan Nikolov <konik98@...il.com> Subject: Re: [PATCH net] mwifiex: Increase AES key storage size to 256 bits On 8/25/20 9:30 PM, Brian Norris wrote: > Also, while technically the regressing commit (e18696786548 ("mwifiex: > Prevent memory corruption handling keys")) was fixing a potential > overflow, the encasing command structure (struct host_cmd_ds_command) > is a union of a ton of other command layouts, and likely had plenty of > padding at the end, which would at least explain why non-malicious > scenarios weren't problematic pre-commit-e18696786548. This is pretty much spot on, although as far as I can tell, the padding comes from struct mwifiex_ie_type_key_param_set_v2. That contains a key_params member, which is a union over all supported key types, including other 256 bit types (like struct mwifiex_wapi_param). I should also note that this fix also affects mwifiex_set_aes_key_v2(), where sizeof(struct mwifiex_aes_param) is used to calculate the command length of what looks like a command being sent to the chip. This should probably be reviewed by someone with a bit more inside knowledge about the driver, as this could potentially break something due to the commit changing it from 16 to 32. I think, however, that this might actually also fix a potential issue when setting 256 bit AES keys. Regards, Max
Powered by blists - more mailing lists