Re: [PATCH 1/2] crypto: rsassa-pkcs1: reject undersized keys when signing

[Sudhakar Kuppusamy <sudhakar@linux.ibm.com>]

> On 26 Aug 2026, at 4:07 PM, Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> wrote:
> 
> rsassa_pkcs1_sign() subtracts 11 from the unsigned key size before
> checking that the key is large enough for PKCS#1 v1.5 padding:
> 
> if (slen + hash_prefix->size > ctx->key_size - 11)
> return -EOVERFLOW;
> 
> If the RSA modulus is shorter than 11 bytes, the subtraction wraps.
> With a one-byte key and hash=none, the padding memset() writes past
> the output buffer.
> 
> KASAN reports:
> 
>    BUG: KASAN: slab-out-of-bounds in rsassa_pkcs1_sign+0x1ad/0x3b0
>    Write of size 4294967294 at addr ...
>    The buggy address is located 0 bytes to the right of
>     allocated 1-byte region [...]
> 
> Reject keys shorter than the minimum encoded message size.
> 
> Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>


Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>


Thanks,
Sudhakar

> ---
> crypto/rsassa-pkcs1.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/crypto/rsassa-pkcs1.c b/crypto/rsassa-pkcs1.c
> index 94fa5e9600e7..d0e4a885397f 100644
> --- a/crypto/rsassa-pkcs1.c
> +++ b/crypto/rsassa-pkcs1.c
> @@ -169,7 +169,7 @@ static int rsassa_pkcs1_sign(struct crypto_sig *tfm,
> u8 *in_buf;
> int err;
> 
> - if (!ctx->key_size)
> + if (ctx->key_size < 11)
> return -EINVAL;
> 
> if (dlen < ctx->key_size)
> -- 
> 2.47.3
> 
>