From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753865AbdKGRm7 (ORCPT ); Tue, 7 Nov 2017 12:42:59 -0500 Received: from mail-it0-f43.google.com ([209.85.214.43]:52718 "EHLO mail-it0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753761AbdKGRm4 (ORCPT ); Tue, 7 Nov 2017 12:42:56 -0500 X-Google-Smtp-Source: ABhQp+SFSEX8Xty/KtVYDmkVQtbPRBjWWsfu/1TWlm5fLEXHtnqMsNCkLGu2tldNDhZ/btFUxLLpCQ== Date: Tue, 7 Nov 2017 09:42:50 -0800 From: Eric Biggers To: David Howells Cc: jmorris@namei.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] KEYS: fix NULL pointer dereference during ASN.1 parsing Message-ID: <20171107174250.GA83529@google.com> References: <151006796722.16605.11845942372349233494.stgit@warthog.procyon.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <151006796722.16605.11845942372349233494.stgit@warthog.procyon.org.uk> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Nov 07, 2017 at 03:19:27PM +0000, David Howells wrote: > From: Eric Biggers > > syzkaller reported a NULL pointer dereference in asn1_ber_decoder(). It > can be reproduced by the following command, assuming > CONFIG_PKCS7_TEST_KEY=y: > > keyctl add pkcs7_test desc '' @s > > The bug is that if the data buffer is empty, an integer underflow occurs > in the following check: > > if (unlikely(dp >= datalen - 1)) > goto data_overrun_error; > > This results in the NULL data pointer being dereferenced. > > Fix it by checking for 'datalen - dp < 2' instead. > > Also fix the similar check for 'dp >= datalen - n' later in the same > function. That one possibly could result in a buffer overread. > > The NULL pointer dereference was reproducible using the "pkcs7_test" key > type but not the "asymmetric" key type because the "asymmetric" key type > checks for a 0-length payload before calling into the ASN.1 decoder but > the "pkcs7_test" key type does not. > > The bug report was: > > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233 > PGD 7b708067 P4D 7b708067 PUD 7b6ee067 PMD 0 > Oops: 0000 [#1] SMP > Modules linked in: > CPU: 0 PID: 522 Comm: syz-executor1 Not tainted 4.14.0-rc8 #7 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.3-20171021_125229-anatol 04/01/2014 > task: ffff9b6b3798c040 task.stack: ffff9b6b37970000 > RIP: 0010:asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233 > RSP: 0018:ffff9b6b37973c78 EFLAGS: 00010216 > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000021c > RDX: ffffffff814a04ed RSI: ffffb1524066e000 RDI: ffffffff910759e0 > RBP: ffff9b6b37973d60 R08: 0000000000000001 R09: ffff9b6b3caa4180 > R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 > R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 > FS: 00007f10ed1f2700(0000) GS:ffff9b6b3ea00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000000 CR3: 000000007b6f3000 CR4: 00000000000006f0 > Call Trace: > pkcs7_parse_message+0xee/0x240 crypto/asymmetric_keys/pkcs7_parser.c:139 > verify_pkcs7_signature+0x33/0x180 certs/system_keyring.c:216 > pkcs7_preparse+0x41/0x70 crypto/asymmetric_keys/pkcs7_key_type.c:63 > key_create_or_update+0x180/0x530 security/keys/key.c:855 > SYSC_add_key security/keys/keyctl.c:122 [inline] > SyS_add_key+0xbf/0x250 security/keys/keyctl.c:62 > entry_SYSCALL_64_fastpath+0x1f/0xbe > RIP: 0033:0x4585c9 > RSP: 002b:00007f10ed1f1bd8 EFLAGS: 00000216 ORIG_RAX: 00000000000000f8 > RAX: ffffffffffffffda RBX: 00007f10ed1f2700 RCX: 00000000004585c9 > RDX: 0000000020000000 RSI: 0000000020008ffb RDI: 0000000020008000 > RBP: 0000000000000000 R08: ffffffffffffffff R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000216 R12: 00007fff1b2260ae > R13: 00007fff1b2260af R14: 00007f10ed1f2700 R15: 0000000000000000 > Code: dd ca ff 48 8b 45 88 48 83 e8 01 4c 39 f0 0f 86 a8 07 00 00 e8 53 dd ca ff 49 8d 46 01 48 89 85 58 ff ff ff 48 8b 85 60 ff ff ff <42> 0f b6 0c 30 89 c8 88 8d 75 ff ff ff 83 e0 1f 89 8d 28 ff ff > RIP: asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233 RSP: ffff9b6b37973c78 > CR2: 0000000000000000 > > Fixes: 42d5ec27f873 ("X.509: Add an ASN.1 decoder") > Reported-by: syzbot > Cc: # v3.7+ > Signed-off-by: Eric Biggers > Signed-off-by: David Howells If it's not too late can you fix the From: line to have my @google.com address to match the Signed-off-by? From: Eric Biggers Also feel free to trim down the register dump like you asked. Thanks! Eric