linux-kernel - Re: [PATCH -next] Revert "evm: Fix memleak in init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2df1631b-3c3c-be97-0e93-a1ade05828c2@huawei.com>
Date:   Sat, 11 Jun 2022 10:38:07 +0800
From:   "Guozihua (Scott)" <guozihua@...wei.com>
To:     Mimi Zohar <zohar@...ux.ibm.com>,
        Xiu Jianfeng <xiujianfeng@...wei.com>,
        <dmitry.kasatkin@...il.com>, <jmorris@...ei.org>,
        <serge@...lyn.com>
CC:     <linux-integrity@...r.kernel.org>,
        <linux-security-module@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH -next] Revert "evm: Fix memleak in init_desc"

On 2022/6/10 22:20, Mimi Zohar wrote:
> On Fri, 2022-05-27 at 19:17 +0800, Xiu Jianfeng wrote:
>> This reverts commit ccf11dbaa07b328fa469415c362d33459c140a37.
>>
>> Commit ccf11dbaa07b ("evm: Fix memleak in init_desc") said there is
>> memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is
>> saved in one of the two global variables hmac_tfm ohr evm_tfm[hash_algo],
>> then if init_desc is called next time, there is no need to alloc tfm
>> again, so in the error path of kmalloc desc or crypto_shash_init(desc),
>> It is not a problem without freeing tmp_tfm.
>>
>> And also that commit did not reset the global variable to NULL after
>> freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a
>> UAF issue.
>>
>> Signed-off-by: Xiu Jianfeng <xiujianfeng@...wei.com>
> 
> Agreed, thanks.  This was first reported by Guozihua (Scott) <
> guozihua@...wei.com>.  If neither you nor Scott object, I'll add his
> Reported-by tag.
> 
> thanks,
> 
> Mimi
> 
> .

Good for me.

-- 
Best
GUO Zihua