* [PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set [not found] ` <CAHC9VhS7sZQaPaRswKQ1ETrReEPB2f5buNAMGSXqZ1iBKTs+bg@mail.gmail.com> @ 2026-09-20 23:52 ` Hui Peng 2026-09-25 15:50 ` Ignat Korchagin 0 siblings, 1 reply; 2+ messages in thread From: Hui Peng @ 2026-09-20 23:52 UTC (permalink / raw) To: David Howells, Lukas Wunner, Ignat Korchagin Cc: Herbert Xu, Paul Moore, keyrings, linux-crypto, linux-security-module, linux-kernel, Hui Peng, stable In x509_get_sig_params(), when sig->algo_takes_data is true, sig->m is assigned (u8 *)cert->tbs with sig->m_free = false. However, cert->tbs points into the temporary ASN.1 buffer (prep->data) passed to x509_cert_parse(), while cert->sig is retained in prep->payload.data[asym_auth] by x509_key_preparse() after prep->data is freed by the caller. Subsequent signature verification on the key's public_key_signature dereferences the freed TBS buffer. Duplicate cert->tbs with kmemdup() and set sig->m_free = true so sig->m remains valid for the lifetime of struct public_key_signature. Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by adding an ML-DSA-44 (OID 2.16.840.1.101.3.4.3.17) X.509 certificate via add_key("asymmetric", ...) and linking it into a signature-restricted keyring via keyctl(KEYCTL_LINK), which triggers the following KASAN slab-use-after-free before this patch: BUG: KASAN: slab-use-after-free in mldsa_verify+0x95/0xa0 [mldsa] Read of size 1 at addr ffff88800108c004 by task init/1 Call Trace: <TASK> dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 mldsa_verify+0x95/0xa0 [mldsa] public_key_verify_signature+0x5cb/0x8e0 verify_signature+0xe4/0x130 key_or_keyring_common+0x428/0x850 key_link+0x22e/0x360 keyctl_keyring_link+0x6b/0xc0 __do_sys_keyctl+0x146/0x4f0 do_syscall_64+0xda/0x4b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 1: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kvmalloc_node_noprof+0x1c2/0x5b0 __do_sys_add_key+0x1c2/0x390 do_syscall_64+0xda/0x4b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x47/0x70 kfree+0x159/0x420 __do_sys_add_key+0x2b3/0x390 do_syscall_64+0xda/0x4b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88800108c000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 4 bytes inside of freed 4096-byte region [ffff88800108c000, ffff88800108d000) Fixes: f3eccecd782d ("pkcs7: Allow the signing algo to do whatever digestion it wants itself") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Hui Peng <benquike@gmail.com> --- Changes in v2: - Dropped the net/netlabel/netlabel_calipso.c change, keeping only the crypto/asymmetric_keys/x509_public_key.c fix. - Added the KASAN slab-use-after-free report and test description to the commit message. crypto/asymmetric_keys/x509_public_key.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c index 25cf8ac7f257..5c9165a83f91 100644 --- a/crypto/asymmetric_keys/x509_public_key.c +++ b/crypto/asymmetric_keys/x509_public_key.c @@ -53,9 +53,11 @@ int x509_get_sig_params(struct x509_certificate *cert) if (sig->algo_takes_data) { /* The signature algorithm does whatever passes for hashing. */ - sig->m = (u8 *)cert->tbs; + sig->m = kmemdup(cert->tbs, cert->tbs_size, GFP_KERNEL); + if (!sig->m) + return -ENOMEM; sig->m_size = cert->tbs_size; - sig->m_free = false; + sig->m_free = true; goto out; } -- 2.47.3 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set 2026-09-20 23:52 ` [PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set Hui Peng @ 2026-09-25 15:50 ` Ignat Korchagin 0 siblings, 0 replies; 2+ messages in thread From: Ignat Korchagin @ 2026-09-25 15:50 UTC (permalink / raw) To: Hui Peng Cc: David Howells, Lukas Wunner, Herbert Xu, Paul Moore, keyrings, linux-crypto, linux-security-module, linux-kernel, stable On Mon, Sep 21, 2026 at 12:52 AM Hui Peng <benquike@gmail.com> wrote: > > In x509_get_sig_params(), when sig->algo_takes_data is true, sig->m is > assigned (u8 *)cert->tbs with sig->m_free = false. However, cert->tbs > points into the temporary ASN.1 buffer (prep->data) passed to > x509_cert_parse(), while cert->sig is retained in > prep->payload.data[asym_auth] by x509_key_preparse() after prep->data > is freed by the caller. Subsequent signature verification on the key's > public_key_signature dereferences the freed TBS buffer. > > Duplicate cert->tbs with kmemdup() and set sig->m_free = true so sig->m > remains valid for the lifetime of struct public_key_signature. > > Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by adding an > ML-DSA-44 (OID 2.16.840.1.101.3.4.3.17) X.509 certificate via > add_key("asymmetric", ...) and linking it into a signature-restricted > keyring via keyctl(KEYCTL_LINK), which triggers the following KASAN > slab-use-after-free before this patch: > > BUG: KASAN: slab-use-after-free in mldsa_verify+0x95/0xa0 [mldsa] > Read of size 1 at addr ffff88800108c004 by task init/1 > > Call Trace: > <TASK> > dump_stack_lvl+0x70/0xa0 > print_report+0x153/0x4c6 > kasan_report+0xf1/0x120 > mldsa_verify+0x95/0xa0 [mldsa] > public_key_verify_signature+0x5cb/0x8e0 > verify_signature+0xe4/0x130 > key_or_keyring_common+0x428/0x850 > key_link+0x22e/0x360 > keyctl_keyring_link+0x6b/0xc0 > __do_sys_keyctl+0x146/0x4f0 > do_syscall_64+0xda/0x4b0 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > </TASK> > > Allocated by task 1: > kasan_save_stack+0x30/0x50 > kasan_save_track+0x14/0x30 > __kasan_kmalloc+0x7f/0x90 > __kvmalloc_node_noprof+0x1c2/0x5b0 > __do_sys_add_key+0x1c2/0x390 > do_syscall_64+0xda/0x4b0 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Freed by task 1: > kasan_save_stack+0x30/0x50 > kasan_save_track+0x14/0x30 > kasan_save_free_info+0x3b/0x70 > __kasan_slab_free+0x47/0x70 > kfree+0x159/0x420 > __do_sys_add_key+0x2b3/0x390 > do_syscall_64+0xda/0x4b0 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > The buggy address belongs to the object at ffff88800108c000 > which belongs to the cache kmalloc-4k of size 4096 > The buggy address is located 4 bytes inside of > freed 4096-byte region [ffff88800108c000, ffff88800108d000) > > Fixes: f3eccecd782d ("pkcs7: Allow the signing algo to do whatever digestion it wants itself") > Cc: stable@vger.kernel.org > Assisted-by: LLM > Signed-off-by: Hui Peng <benquike@gmail.com> Reviewed-by: Ignat Korchagin <ignat@linux.win> > --- > Changes in v2: > - Dropped the net/netlabel/netlabel_calipso.c change, keeping only the > crypto/asymmetric_keys/x509_public_key.c fix. > - Added the KASAN slab-use-after-free report and test description to the > commit message. > > crypto/asymmetric_keys/x509_public_key.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c > index 25cf8ac7f257..5c9165a83f91 100644 > --- a/crypto/asymmetric_keys/x509_public_key.c > +++ b/crypto/asymmetric_keys/x509_public_key.c > @@ -53,9 +53,11 @@ int x509_get_sig_params(struct x509_certificate *cert) > > if (sig->algo_takes_data) { > /* The signature algorithm does whatever passes for hashing. */ > - sig->m = (u8 *)cert->tbs; > + sig->m = kmemdup(cert->tbs, cert->tbs_size, GFP_KERNEL); > + if (!sig->m) > + return -ENOMEM; > sig->m_size = cert->tbs_size; > - sig->m_free = false; > + sig->m_free = true; > goto out; > } > > -- > 2.47.3 > Thanks ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-25 15:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260919223438.3883567-1-benquike@gmail.com>
[not found] ` <CAHC9VhS7sZQaPaRswKQ1ETrReEPB2f5buNAMGSXqZ1iBKTs+bg@mail.gmail.com>
2026-09-20 23:52 ` [PATCH v2] certs: x509: duplicate cert->tbs when sig->algo_takes_data is set Hui Peng
2026-09-25 15:50 ` Ignat Korchagin
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox