Andrey Ryabinin
f5527fffff
mpi: Fix NULL ptr dereference in mpi_powm() [ver #3 ]
...
This fixes CVE-2016-8650.
If mpi_powm() is given a zero exponent, it wants to immediately return
either 1 or 0, depending on the modulus. However, if the result was
initalised with zero limb space, no limbs space is allocated and a
NULL-pointer exception ensues.
Fix this by allocating a minimal amount of limb space for the result when
the 0-exponent case when the result is 1 and not touching the limb space
when the result is 0.
This affects the use of RSA keys and X.509 certificates that carry them.
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
PGD 0
Oops: 0002 [#1 ] SMP
Modules linked in:
CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
task: ffff8804011944c0 task.stack: ffff880401294000
RIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
RSP: 0018:ffff880401297ad8 EFLAGS: 00010212
RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0
RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0
RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000
R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50
FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0
Stack:
ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4
0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30
ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8
Call Trace:
[<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66
[<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d
[<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd
[<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146
[<ffffffff8132a95c>] rsa_verify+0x9d/0xee
[<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb
[<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1
[<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228
[<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4
[<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1
[<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1
[<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61
[<ffffffff812fc9f3>] key_create_or_update+0x145/0x399
[<ffffffff812fe227>] SyS_add_key+0x154/0x19e
[<ffffffff81001c2b>] do_syscall_64+0x80/0x191
[<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25
Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f
RIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
RSP <ffff880401297ad8>
CR2: 0000000000000000
---[ end trace d82015255d4a5d8d ]---
Basically, this is a backport of a libgcrypt patch:
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526
Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
cc: linux-ima-devel@lists.sourceforge.net
cc: stable@vger.kernel.org
Signed-off-by: James Morris <james.l.morris@oracle.com>
2016-11-25 12:57:50 +11:00
..
2016-03-17 21:38:27 -07:00
2014-10-09 11:35:48 +03:00
2016-04-13 09:22:49 -07:00
2014-09-28 11:08:01 +02:00
2016-11-25 12:57:50 +11:00
2016-10-07 09:45:43 -07:00
2014-06-04 16:54:18 -07:00
2015-09-10 13:29:01 -07:00
2014-08-06 18:01:24 -07:00
2012-10-08 13:50:18 +10:30
2013-04-29 18:28:19 -07:00
2016-05-17 09:33:39 -07:00
2016-04-06 14:06:48 +01:00
2016-10-07 18:46:30 -07:00
locking/atomic: Implement atomic{,64,_long}_fetch_{add,sub,and,andnot,or,xor}{,_relaxed,_acquire,_release}()
2016-06-16 10:48:32 +02:00
2014-12-13 12:42:51 -08:00
2012-09-10 11:13:16 -07:00
2016-10-11 15:06:30 -07:00
2014-12-22 16:43:06 +00:00
2012-03-07 15:04:04 -05:00
2015-11-23 09:44:58 +01:00
2016-03-17 15:09:34 -07:00
2013-06-19 17:54:06 +02:00
2013-03-22 16:41:20 -07:00
2016-07-03 00:57:23 -04:00
2012-03-07 15:04:04 -05:00
2016-03-13 23:55:13 -04:00
2014-04-03 16:21:12 -07:00
2012-02-02 10:34:23 +11:00
2014-10-03 18:40:58 +01:00
2014-03-20 10:11:35 -04:00
2015-05-27 15:22:15 +02:00
2016-09-19 21:44:31 +02:00
2016-02-29 09:35:20 +01:00
2014-05-16 14:26:52 -04:00
2016-08-02 19:35:08 -04:00
2012-03-23 16:58:38 -07:00
2015-05-26 15:26:43 +02:00
2015-05-30 22:42:24 -07:00
2012-03-07 15:04:04 -05:00
2015-06-11 15:08:32 +02:00
2013-06-26 12:10:56 +02:00
2016-05-19 19:12:14 -07:00
2012-03-07 15:04:04 -05:00
2015-09-10 13:29:01 -07:00
2015-09-10 13:29:01 -07:00
2015-09-10 13:29:01 -07:00
2015-09-10 13:29:01 -07:00
2015-09-10 13:29:01 -07:00
2015-09-10 13:29:01 -07:00
2015-07-17 16:39:54 -07:00
2016-02-07 23:17:59 -08:00
2016-05-31 16:42:00 +08:00
2015-11-16 14:42:12 -05:00
2016-10-06 17:13:54 -07:00
2016-08-04 08:50:07 -04:00
2016-02-05 18:10:40 -08:00
2016-08-04 08:50:07 -04:00
2015-02-12 18:54:15 -08:00
2016-06-08 11:04:19 +02:00
2016-02-24 14:57:26 +00:00
2015-10-23 17:55:10 +09:00
2014-04-30 19:49:37 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2015-04-17 09:03:54 -04:00
2014-01-21 23:17:20 -08:00
2016-02-15 11:18:23 +01:00
2016-05-20 17:58:30 -07:00
2015-02-13 21:21:35 -08:00
2016-10-27 18:43:43 -07:00
2014-08-06 18:01:25 -07:00
2015-11-06 17:50:42 -08:00
2015-11-06 17:50:42 -08:00
2016-06-08 15:01:02 +02:00
2015-11-06 17:50:42 -08:00
2013-04-29 18:28:19 -07:00
2014-05-05 09:09:14 +02:00
2015-02-12 18:54:15 -08:00
2016-01-20 17:09:18 -08:00
2014-04-07 16:36:11 -07:00
2015-11-05 16:34:48 -08:00
2016-08-02 19:35:07 -04:00
2015-04-14 16:49:04 -07:00
2016-11-17 00:00:48 -05:00
2016-10-15 10:03:15 -07:00
2012-03-07 15:04:04 -05:00
2015-11-06 17:50:42 -08:00
2012-05-02 00:04:06 -07:00
2016-01-16 11:17:27 -08:00
2016-10-07 21:38:00 -07:00
2016-11-18 11:33:19 -08:00
2016-07-28 16:07:41 -07:00
2016-05-23 17:04:14 -07:00
2016-09-20 14:26:08 +02:00
2014-08-08 15:57:25 -07:00
2016-02-07 22:18:47 -08:00
2015-02-12 18:54:15 -08:00
2016-02-09 17:36:34 -08:00
2016-10-11 15:06:30 -07:00
2011-10-31 17:30:56 -07:00
2015-03-31 09:45:50 -06:00
2016-01-22 11:58:43 -08:00
2016-03-09 15:43:42 -08:00
2015-06-16 14:12:35 -04:00
2015-11-06 17:50:42 -08:00
2014-10-03 06:09:30 +02:00
2015-08-12 11:59:04 +02:00
2015-11-25 09:22:02 -07:00
2016-10-11 15:06:32 -07:00
2015-02-12 18:54:15 -08:00
2012-07-30 17:25:22 -07:00
2012-07-30 17:25:16 -07:00
2014-06-25 17:45:43 -07:00
2015-12-03 11:49:23 -05:00
2016-04-23 20:13:24 -04:00
2016-10-07 18:46:30 -07:00
2016-05-19 19:12:14 -07:00
2013-04-09 14:13:05 -04:00
2012-07-30 17:25:22 -07:00
2012-12-14 10:32:52 +11:00
2013-05-05 14:38:00 -07:00
2015-10-08 05:26:36 -07:00
2014-01-23 16:36:55 -08:00
2015-09-08 14:35:59 -07:00
2016-05-19 19:12:14 -07:00
2015-11-06 17:50:42 -08:00
2013-11-13 12:09:11 +09:00
2016-08-11 13:52:23 -04:00
2015-02-12 18:54:16 -08:00
2012-07-30 17:25:22 -07:00
2016-10-05 09:17:56 -07:00
2016-10-15 10:03:15 -07:00
2016-08-02 19:35:06 -04:00
2012-05-17 15:18:37 +02:00
2014-01-23 16:37:03 -08:00
2016-07-06 10:51:14 +01:00
2014-01-21 23:17:20 -08:00
2016-09-20 04:43:36 -04:00
2016-09-19 08:19:40 -06:00
2016-02-08 10:15:17 -08:00
2015-12-23 14:27:20 -05:00
2016-04-15 16:53:14 -04:00
2015-08-24 14:28:01 -06:00
2015-03-23 22:12:08 -04:00
2015-09-08 15:35:28 -07:00
2014-04-07 16:36:14 -07:00
2015-06-25 17:00:40 -07:00
2016-11-11 08:12:37 -08:00
2015-02-12 18:54:16 -08:00
2016-04-21 10:47:26 +10:00
2016-03-17 15:09:34 -07:00
2016-10-11 15:06:30 -07:00
2016-08-08 13:02:01 -07:00
2016-08-04 08:50:07 -04:00
2016-09-16 09:18:53 +02:00
2016-02-19 22:54:09 -05:00
2016-10-20 14:39:06 -04:00
2016-01-07 13:44:22 -07:00
2016-09-01 17:52:01 -07:00
2016-01-20 17:09:18 -08:00
2016-05-20 17:58:30 -07:00
2014-01-23 16:36:57 -08:00
2016-03-15 16:55:16 -07:00
2016-08-08 12:52:42 -07:00
2015-08-03 11:51:12 +02:00
2016-02-09 10:27:29 +01:00
2014-01-23 16:36:57 -08:00
2016-05-30 15:26:57 -07:00
2015-09-10 13:29:01 -07:00
2016-02-03 08:28:43 -08:00
2014-10-14 02:18:14 +02:00
2015-04-22 17:06:49 +02:00
2016-08-02 17:31:41 -04:00
2016-01-20 17:09:18 -08:00
2016-09-09 16:08:46 +01:00
2016-05-30 15:26:57 -07:00
2016-05-20 17:58:30 -07:00
2016-09-21 00:22:59 -04:00