From: ebiggers3@gmail.com (Eric Biggers)
To: linux-security-module@vger.kernel.org
Subject: [PATCH 1/5] KEYS: sanitize add_key() and keyctl() key payloads
Date: Fri, 28 Apr 2017 10:57:12 -0700 [thread overview]
Message-ID: <20170428175712.GA14932@gmail.com> (raw)
In-Reply-To: <20170421083037.12746-2-ebiggers3@gmail.com>
Hey David,
On Fri, Apr 21, 2017 at 01:30:33AM -0700, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> Before returning from add_key() or one of the keyctl() commands that
> takes in a key payload, zero the temporary buffer that was allocated to
> hold the key payload copied from userspace. This may contain sensitive
> key material that should not be kept around in the slab caches.
>
> This must not be applied before the patch "KEYS: fix dereferencing NULL
> payload with nonzero length".
>
> Signed-off-by: Eric Biggers <ebiggers@google.com>
Can you make sure that my other patch "KEYS: fix dereferencing NULL payload with
nonzero length" gets applied along with this one? Otherwise triggering the NULL
pointer dereference (which really needs to be fixed anyway) becomes even more
trivial. The only reason I didn't check for NULL before doing the memsets is
that the bug was going to have to be fixed anyway, and the fix backported.
- Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2017-04-28 17:57 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-21 8:30 [PATCH 0/5] KEYS: sanitize key payloads Eric Biggers
2017-04-21 8:30 ` [PATCH 1/5] KEYS: sanitize add_key() and keyctl() " Eric Biggers
2017-04-28 17:57 ` Eric Biggers [this message]
2017-04-21 8:30 ` [PATCH 2/5] KEYS: user_defined: sanitize " Eric Biggers
2017-04-21 8:30 ` [PATCH 3/5] KEYS: encrypted: sanitize all key material Eric Biggers
2017-04-21 8:30 ` [PATCH 4/5] KEYS: trusted: " Eric Biggers
2017-04-21 8:30 ` [PATCH 5/5] KEYS: sanitize key structs before freeing Eric Biggers
2017-04-21 13:57 ` [PATCH 2/5] KEYS: user_defined: sanitize key payloads David Howells
2017-04-21 18:34 ` Eric Biggers
2017-04-24 14:14 ` David Howells
2017-04-21 14:31 ` [PATCH 3/5] KEYS: encrypted: sanitize all key material David Howells
2017-04-21 18:24 ` Eric Biggers
2017-04-24 14:14 ` David Howells
2017-04-27 15:09 ` [PATCH 0/5] KEYS: sanitize key payloads David Howells
2017-04-27 17:43 ` Eric Biggers
2017-06-02 15:34 ` [PATCH 1/5] KEYS: sanitize add_key() and keyctl() " David Howells
2017-06-02 17:24 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170428175712.GA14932@gmail.com \
--to=ebiggers3@gmail.com \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).