From: Eric Biggers <ebiggers@kernel.org>
To: Jarkko Sakkinen <jarkko@kernel.org>
Cc: keyrings@vger.kernel.org, David Howells <dhowells@redhat.com>,
linux-crypto@vger.kernel.org,
Marcel Holtmann <marcel@holtmann.org>,
Denis Kenzior <denkenz@gmail.com>,
stable@vger.kernel.org
Subject: Re: [PATCH] KEYS: fix length validation in keyctl_pkey_params_get_2()
Date: Sat, 15 Jan 2022 11:53:34 -0800 [thread overview]
Message-ID: <YeMmPs+gf+q7XUv4@sol.localdomain> (raw)
In-Reply-To: <YeMWLyceg4xcwShF@iki.fi>
On Sat, Jan 15, 2022 at 08:45:03PM +0200, Jarkko Sakkinen wrote:
> On Thu, Jan 13, 2022 at 12:04:54PM -0800, Eric Biggers wrote:
> > From: Eric Biggers <ebiggers@google.com>
> >
> > In many cases, keyctl_pkey_params_get_2() is validating the user buffer
> > lengths against the wrong algorithm properties. Fix it to check against
> > the correct properties.
> >
> > Probably this wasn't noticed before because for all asymmetric keys of
> > the "public_key" subtype, max_data_size == max_sig_size == max_enc_size
> > == max_dec_size. However, this isn't necessarily true for the
> > "asym_tpm" subtype (it should be, but it's not strictly validated). Of
> > course, future key types could have different values as well.
>
> With a quick look, asym_tpm is TPM 1.x only, which only has 2048-bit RSA
> keys.
The code allows other lengths, as well as the case where the "RSA key size"
doesn't match the "public key size". Probably both are bugs and they should
both be 256 bytes (2048 bits) only. Anyway, that would be a separate fix.
- Eric
next prev parent reply other threads:[~2022-01-15 19:53 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-13 20:04 [PATCH] KEYS: fix length validation in keyctl_pkey_params_get_2() Eric Biggers
2022-01-15 18:45 ` Jarkko Sakkinen
2022-01-15 19:53 ` Eric Biggers [this message]
2022-01-15 21:26 ` Jarkko Sakkinen
2022-01-19 0:22 ` Eric Biggers
2022-01-26 14:06 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YeMmPs+gf+q7XUv4@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=denkenz@gmail.com \
--cc=dhowells@redhat.com \
--cc=jarkko@kernel.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox