[PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set

[PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set

[Hui Peng]

In x509_get_sig_params(), when sig->algo_takes_data is true, sig->m is
assigned (u8 *)cert->tbs with sig->m_free = false. However, cert->tbs
points into the temporary ASN.1 buffer (prep->data) passed to
x509_cert_parse(), while cert->sig is retained in
prep->payload.data[asym_auth] by x509_key_preparse() after prep->data
is freed by the caller. Subsequent signature verification on the key's
public_key_signature dereferences the freed TBS buffer.

Duplicate cert->tbs with kmemdup() and set sig->m_free = true so sig->m
remains valid for the lifetime of struct public_key_signature.

Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by adding an
ML-DSA-44 (OID 2.16.840.1.101.3.4.3.17) X.509 certificate via
add_key("asymmetric", ...) and linking it into a signature-restricted
keyring via keyctl(KEYCTL_LINK), which triggers the following KASAN
slab-use-after-free before this patch:

  BUG: KASAN: slab-use-after-free in mldsa_verify+0x95/0xa0 [mldsa]
  Read of size 1 at addr ffff88800108c004 by task init/1

  Call Trace:
   <TASK>
   dump_stack_lvl+0x70/0xa0
   print_report+0x153/0x4c6
   kasan_report+0xf1/0x120
   mldsa_verify+0x95/0xa0 [mldsa]
   public_key_verify_signature+0x5cb/0x8e0
   verify_signature+0xe4/0x130
   key_or_keyring_common+0x428/0x850
   key_link+0x22e/0x360
   keyctl_keyring_link+0x6b/0xc0
   __do_sys_keyctl+0x146/0x4f0
   do_syscall_64+0xda/0x4b0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

  Allocated by task 1:
   kasan_save_stack+0x30/0x50
   kasan_save_track+0x14/0x30
   __kasan_kmalloc+0x7f/0x90
   __kvmalloc_node_noprof+0x1c2/0x5b0
   __do_sys_add_key+0x1c2/0x390
   do_syscall_64+0xda/0x4b0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

  Freed by task 1:
   kasan_save_stack+0x30/0x50
   kasan_save_track+0x14/0x30
   kasan_save_free_info+0x3b/0x70
   __kasan_slab_free+0x47/0x70
   kfree+0x159/0x420
   __do_sys_add_key+0x2b3/0x390
   do_syscall_64+0xda/0x4b0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

  The buggy address belongs to the object at ffff88800108c000
   which belongs to the cache kmalloc-4k of size 4096
  The buggy address is located 4 bytes inside of
   freed 4096-byte region [ffff88800108c000, ffff88800108d000)

Fixes: f3eccecd782d ("pkcs7: Allow the signing algo to do whatever digestion it wants itself")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v2:
- Dropped the net/netlabel/netlabel_calipso.c change, keeping only the
  crypto/asymmetric_keys/x509_public_key.c fix.
- Added the KASAN slab-use-after-free report and test description to the
  commit message.

 crypto/asymmetric_keys/x509_public_key.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 25cf8ac7f257..5c9165a83f91 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -53,9 +53,11 @@ int x509_get_sig_params(struct x509_certificate *cert)
 
 	if (sig->algo_takes_data) {
 		/* The signature algorithm does whatever passes for hashing. */
-		sig->m = (u8 *)cert->tbs;
+		sig->m = kmemdup(cert->tbs, cert->tbs_size, GFP_KERNEL);
+		if (!sig->m)
+			return -ENOMEM;
 		sig->m_size = cert->tbs_size;
-		sig->m_free = false;
+		sig->m_free = true;
 		goto out;
 	}
 
-- 
2.47.3

Re: [PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set

[Ignat Korchagin]

On Mon, Sep 21, 2026 at 12:52 AM Hui Peng <benquike@gmail.com> wrote:
>
> In x509_get_sig_params(), when sig->algo_takes_data is true, sig->m is
> assigned (u8 *)cert->tbs with sig->m_free = false. However, cert->tbs
> points into the temporary ASN.1 buffer (prep->data) passed to
> x509_cert_parse(), while cert->sig is retained in
> prep->payload.data[asym_auth] by x509_key_preparse() after prep->data
> is freed by the caller. Subsequent signature verification on the key's
> public_key_signature dereferences the freed TBS buffer.
>
> Duplicate cert->tbs with kmemdup() and set sig->m_free = true so sig->m
> remains valid for the lifetime of struct public_key_signature.
>
> Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by adding an
> ML-DSA-44 (OID 2.16.840.1.101.3.4.3.17) X.509 certificate via
> add_key("asymmetric", ...) and linking it into a signature-restricted
> keyring via keyctl(KEYCTL_LINK), which triggers the following KASAN
> slab-use-after-free before this patch:
>
>   BUG: KASAN: slab-use-after-free in mldsa_verify+0x95/0xa0 [mldsa]
>   Read of size 1 at addr ffff88800108c004 by task init/1
>
>   Call Trace:
>    <TASK>
>    dump_stack_lvl+0x70/0xa0
>    print_report+0x153/0x4c6
>    kasan_report+0xf1/0x120
>    mldsa_verify+0x95/0xa0 [mldsa]
>    public_key_verify_signature+0x5cb/0x8e0
>    verify_signature+0xe4/0x130
>    key_or_keyring_common+0x428/0x850
>    key_link+0x22e/0x360
>    keyctl_keyring_link+0x6b/0xc0
>    __do_sys_keyctl+0x146/0x4f0
>    do_syscall_64+0xda/0x4b0
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
>    </TASK>
>
>   Allocated by task 1:
>    kasan_save_stack+0x30/0x50
>    kasan_save_track+0x14/0x30
>    __kasan_kmalloc+0x7f/0x90
>    __kvmalloc_node_noprof+0x1c2/0x5b0
>    __do_sys_add_key+0x1c2/0x390
>    do_syscall_64+0xda/0x4b0
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
>   Freed by task 1:
>    kasan_save_stack+0x30/0x50
>    kasan_save_track+0x14/0x30
>    kasan_save_free_info+0x3b/0x70
>    __kasan_slab_free+0x47/0x70
>    kfree+0x159/0x420
>    __do_sys_add_key+0x2b3/0x390
>    do_syscall_64+0xda/0x4b0
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
>   The buggy address belongs to the object at ffff88800108c000
>    which belongs to the cache kmalloc-4k of size 4096
>   The buggy address is located 4 bytes inside of
>    freed 4096-byte region [ffff88800108c000, ffff88800108d000)
>
> Fixes: f3eccecd782d ("pkcs7: Allow the signing algo to do whatever digestion it wants itself")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

Reviewed-by: Ignat Korchagin <ignat@linux.win>

> ---
> Changes in v2:
> - Dropped the net/netlabel/netlabel_calipso.c change, keeping only the
>   crypto/asymmetric_keys/x509_public_key.c fix.
> - Added the KASAN slab-use-after-free report and test description to the
>   commit message.
>
>  crypto/asymmetric_keys/x509_public_key.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
> index 25cf8ac7f257..5c9165a83f91 100644
> --- a/crypto/asymmetric_keys/x509_public_key.c
> +++ b/crypto/asymmetric_keys/x509_public_key.c
> @@ -53,9 +53,11 @@ int x509_get_sig_params(struct x509_certificate *cert)
>
>         if (sig->algo_takes_data) {
>                 /* The signature algorithm does whatever passes for hashing. */
> -               sig->m = (u8 *)cert->tbs;
> +               sig->m = kmemdup(cert->tbs, cert->tbs_size, GFP_KERNEL);
> +               if (!sig->m)
> +                       return -ENOMEM;
>                 sig->m_size = cert->tbs_size;
> -               sig->m_free = false;
> +               sig->m_free = true;
>                 goto out;
>         }
>
> --
> 2.47.3
>

Thanks