linux-kernel - Re: [BUG] crypto: ccree: driver does not handle case where cryptlen = authsize =0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOtvUMfN8U4+eG-TEVW4bSE6kOzuOSsJE4dOYGXYuWQKNzv7wQ@mail.gmail.com>
Date:   Tue, 22 Feb 2022 09:39:20 +0200
From:   Gilad Ben-Yossef <gilad@...yossef.com>
To:     Corentin Labbe <clabbe.montjoie@...il.com>
Cc:     Herbert Xu <herbert@...dor.apana.org.au>,
        Linux Crypto Mailing List <linux-crypto@...r.kernel.org>,
        Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] crypto: ccree: driver does not handle case where cryptlen =
 authsize =0

On Mon, Feb 21, 2022 at 4:05 PM Corentin Labbe
<clabbe.montjoie@...il.com> wrote:
>
> Le Mon, Feb 21, 2022 at 12:08:12PM +0200, Gilad Ben-Yossef a écrit :
> > Hi,
> >
> > On Sun, Feb 20, 2022 at 9:26 PM Corentin Labbe
> > <clabbe.montjoie@...il.com> wrote:
> > >
> > ...
> > >
> > > Hello
> > >
> > > While testing your patch for this problem, I saw another warning (unrelated with your patch):
> >
> > Dear Corentin, you are a treasure trove of bug reports. I love it.
> > Thank you! :-)
> >
> > > [   34.061953] ------------[ cut here ]------------
...
> >
> > So, this is an interesting one.
> > What I *think* is happening is that the drbg implementation is
> > actually doing something naughty: it is passing the same exact memory
> > buffer, both as source and destination to an encryption operation to
> > the crypto skcipher API, BUT via two different scatter gather lists.
> >
> > I'm not sure but I believe this is not a legitimate use of the API,
> > but before we even go into this, let's see if this little fix helps at
> > all and this is indeed the root cause.
> >
> > Can you test this small change for me, please?
> >
> > diff --git a/crypto/drbg.c b/crypto/drbg.c
> > index 177983b6ae38..13824fd27627 100644
> > --- a/crypto/drbg.c
> > +++ b/crypto/drbg.c
> > @@ -1851,7 +1851,7 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
> >                 /* Use scratchpad for in-place operation */
> >                 inlen = scratchpad_use;
> >                 memset(drbg->outscratchpad, 0, scratchpad_use);
> > -               sg_set_buf(sg_in, drbg->outscratchpad, scratchpad_use);
> > +               sg_in = sg_out;
> >         }
> >
> >         while (outlen) {
> >
>
> No more stacktrace !

Thank you. I will send a patch later today.

Cheers,
Gilad

-- 
Gilad Ben-Yossef
Chief Coffee Drinker

values of β will give rise to dom!