iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
bfc0698beb
linux/security/keys
History
Eric Biggers 3619dec510 dh key: fix rounding up KDF output length 
Commit 383203eff7 ("dh key: get rid of stack allocated array") changed
kdf_ctr() to assume that the length of key material to derive is a
multiple of the digest size.  The length was supposed to be rounded up
accordingly.  However, the round_up() macro was used which only gives
the correct result on power-of-2 arguments, whereas not all hash
algorithms have power-of-2 digest sizes.  In some cases this resulted in
a write past the end of the 'outbuf' buffer.

Fix it by switching to roundup(), which works for non-power-of-2 inputs.

Reported-by: syzbot+486f97f892efeb2075a3@syzkaller.appspotmail.com
Reported-by: syzbot+29d17b7898b41ee120a5@syzkaller.appspotmail.com
Reported-by: syzbot+8a608baf8751184ec727@syzkaller.appspotmail.com
Reported-by: syzbot+d04e58bd384f1fe0b112@syzkaller.appspotmail.com
Fixes: 383203eff7 ("dh key: get rid of stack allocated array")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Tycho Andersen <tycho@tycho.ws>
Signed-off-by: James Morris <james.morris@microsoft.com>
2018-06-26 09:43:05 -07:00
..
encrypted-keys License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
big_key.c big key: get rid of stack array allocation 2018-05-11 13:07:45 -07:00
compat_dh.c KEYS: DH: validate __spare field 2017-07-14 11:01:38 +10:00
compat.c KEYS: add SP800-56A KDF support for DH 2017-04-04 22:33:38 +01:00
dh.c dh key: fix rounding up KDF output length 2018-06-26 09:43:05 -07:00
gc.c Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-11-25 08:37:16 -10:00
internal.h security: keys: Replace time_t/timespec with time64_t 2017-11-15 16:38:45 +00:00
Kconfig security/keys: BIG_KEY requires CONFIG_CRYPTO 2017-10-18 09:12:40 +01:00
key.c security: keys: remove redundant assignment to key_ref 2017-12-08 15:13:29 +00:00
keyctl.c KEYS: reject NULL restriction string when type is specified 2017-12-08 15:13:29 +00:00
keyring.c keyring: Remove now-redundant smp_read_barrier_depends() 2017-12-04 10:53:14 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
permission.c security: keys: Replace time_t/timespec with time64_t 2017-11-15 16:38:45 +00:00
persistent.c sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h> 2017-03-02 08:42:31 +01:00
proc.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
process_keys.c security: keys: Replace time_t/timespec with time64_t 2017-11-15 16:38:45 +00:00
request_key_auth.c KEYS: Fix race between updating and finding a negative key 2017-10-18 09:12:40 +01:00
request_key.c KEYS: add missing permission check for request_key() destination 2017-12-08 15:13:27 +00:00
sysctl.c security: Convert use of typedef ctl_table to struct ctl_table 2014-04-15 13:39:58 +10:00
trusted.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
trusted.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
user_defined.c KEYS: Fix race between updating and finding a negative key 2017-10-18 09:12:40 +01:00