Andrey Ryabinin
41ccfd1630
mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]
This fixes CVE-2016-8650.
If mpi_powm() is given a zero exponent, it wants to immediately return
either 1 or 0, depending on the modulus. However, if the result was
initalised with zero limb space, no limbs space is allocated and a
NULL-pointer exception ensues.
Fix this by allocating a minimal amount of limb space for the result when
the 0-exponent case when the result is 1 and not touching the limb space
when the result is 0.
This affects the use of RSA keys and X.509 certificates that carry them.
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
PGD 0
Oops: 0002 [#1] SMP
Modules linked in:
CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
task: ffff8804011944c0 task.stack: ffff880401294000
RIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
RSP: 0018:ffff880401297ad8 EFLAGS: 00010212
RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0
RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0
RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000
R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50
FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0
Stack:
ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4
0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30
ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8
Call Trace:
[<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66
[<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d
[<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd
[<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146
[<ffffffff8132a95c>] rsa_verify+0x9d/0xee
[<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb
[<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1
[<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228
[<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4
[<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1
[<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1
[<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61
[<ffffffff812fc9f3>] key_create_or_update+0x145/0x399
[<ffffffff812fe227>] SyS_add_key+0x154/0x19e
[<ffffffff81001c2b>] do_syscall_64+0x80/0x191
[<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25
Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f
RIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
RSP <ffff880401297ad8>
CR2: 0000000000000000
---[ end trace d82015255d4a5d8d ]---
Basically, this is a backport of a libgcrypt patch:
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526
Fixes: cdec9cb516 ("crypto: GnuPG based MPI lib - source files (part 1)")
Change-Id: Idd4a818262558e061c4654c7bd7ce6379c8fc633
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
cc: linux-ima-devel@lists.sourceforge.net
cc: stable@vger.kernel.org
Signed-off-by: James Morris <james.l.morris@oracle.com>
2018-11-02 10:58:19 +09:00
..
2014-03-23 16:44:42 +01:00
2015-10-22 00:27:05 -08:00
2014-10-30 09:38:22 -07:00
2018-11-02 10:58:19 +09:00
2013-09-10 13:03:41 -07:00
2008-04-18 22:17:17 -04:00
2013-03-13 15:21:48 -07:00
2011-03-22 17:44:17 -07:00
2010-03-12 15:52:44 -08:00
2012-10-08 13:50:18 +10:30
2013-04-29 18:28:19 -07:00
2012-12-19 07:55:08 -08:00
2018-11-02 10:58:14 +09:00
2012-07-30 17:25:16 -07:00
2012-12-20 13:50:16 -08:00
2011-05-04 14:41:28 -04:00
2014-01-16 23:46:06 -08:00
2012-09-10 11:13:16 -07:00
2011-03-11 14:25:50 +00:00
2014-11-14 09:00:08 -08:00
2008-06-06 11:29:10 -07:00
2012-03-07 15:04:04 -05:00
2014-08-07 14:52:39 -07:00
2013-01-21 17:17:57 +10:30
2013-06-19 17:54:06 +02:00
2013-03-22 16:41:20 -07:00
2012-03-07 15:04:04 -05:00
2013-02-11 20:00:33 +05:30
2013-07-09 10:33:30 -07:00
2012-02-02 10:34:23 +11:00
2014-01-23 16:36:57 -08:00
2011-10-29 21:20:22 +02:00
2013-09-13 15:09:52 +02:00
2012-07-30 17:25:22 -07:00
2014-01-21 16:19:47 -08:00
2007-07-17 10:23:04 -07:00
2011-06-03 15:01:06 -04:00
2006-06-25 10:01:20 -07:00
2013-11-04 15:27:08 -05:00
2012-03-23 16:58:38 -07:00
2006-06-25 10:01:20 -07:00
2007-05-10 18:24:13 +02:00
2013-09-12 15:31:34 +10:00
2012-03-07 15:04:04 -05:00
2013-06-26 12:10:56 +02:00
2013-11-13 12:09:22 +09:00
2012-03-07 15:04:04 -05:00
2011-12-06 10:00:05 +01:00
2013-09-11 15:58:38 -07:00
2014-01-23 16:37:04 -08:00
2011-12-06 09:53:40 +01:00
2013-02-20 19:36:00 +01:00
2011-03-31 11:26:23 -03:00
2013-07-09 10:33:30 -07:00
2013-02-27 19:10:09 -08:00
2013-11-13 12:09:22 +09:00
2013-08-23 09:02:14 -04:00
2014-03-04 07:55:47 -08:00
2013-08-06 14:21:01 -07:00
2014-01-27 21:02:39 -08:00
2012-05-31 18:18:17 -04:00
2013-08-14 23:24:01 +02:00
2009-06-12 21:47:04 +09:30
2013-06-03 13:55:01 -07:00
2014-08-12 13:22:45 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-07-23 13:54:52 +01:00
2012-03-07 15:04:04 -05:00
2012-03-07 15:04:04 -05:00
2014-01-21 23:17:20 -08:00
2012-09-25 08:59:21 -07:00
2012-10-06 03:04:57 +09:00
2012-10-06 03:04:46 +09:00
2015-06-10 01:53:28 -07:00
2012-03-07 15:04:04 -05:00
2013-12-19 00:14:53 -05:00
2013-09-20 15:38:26 -04:00
2012-03-07 15:04:04 -05:00
2014-06-30 20:11:54 -07:00
2010-08-12 09:51:35 -07:00
2013-04-29 18:28:19 -07:00
2012-12-17 17:15:26 -08:00
2012-10-09 16:22:40 +09:00
2012-03-07 15:04:04 -05:00
2012-03-07 15:04:04 -05:00
2012-03-24 10:24:31 -07:00
2012-03-07 15:04:04 -05:00
2013-05-20 10:24:22 +09:30
2012-03-07 15:04:04 -05:00
2009-07-17 09:11:31 +10:00
2012-05-02 00:04:06 -07:00
2012-10-11 08:50:15 +09:00
2013-11-21 19:46:00 -08:00
2014-03-19 13:09:45 -07:00
2013-06-18 13:48:45 +02:00
2009-07-01 22:28:44 +02:00
2013-11-15 09:32:23 +09:00
2013-05-21 10:16:39 -07:00
2014-01-19 20:02:02 -08:00
2014-01-30 20:08:20 -08:00
2014-01-23 16:36:57 -08:00
2011-10-31 17:30:56 -07:00
2012-03-07 15:04:04 -05:00
2008-12-25 11:01:42 +11:00
2012-07-06 06:01:49 -07:00
2013-04-29 18:28:42 -07:00
2013-11-15 09:32:22 +09:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2006-07-03 15:27:03 -07:00
2013-09-25 14:07:32 +02:00
2013-11-27 20:37:33 -08:00
2013-03-22 22:17:36 -06:00
2014-08-12 13:22:45 +01:00
2012-03-07 15:04:04 -05:00
2012-07-30 17:25:22 -07:00
2012-07-30 17:25:16 -07:00
2013-06-05 12:00:27 -07:00
2014-06-26 15:15:38 -04:00
2013-04-09 14:13:05 -04:00
2012-07-30 17:25:22 -07:00
2012-12-14 10:32:52 +11:00
2013-05-05 14:38:00 -07:00
2014-01-23 16:36:55 -08:00
2012-01-31 23:19:47 +02:00
2014-05-13 13:32:56 +02:00
2014-02-14 10:45:18 -08:00
2013-11-13 12:09:11 +09:00
2014-01-21 04:40:56 -05:00
2014-10-09 12:21:27 -07:00
2012-07-30 17:25:22 -07:00
2009-01-06 15:59:11 -08:00
2011-09-13 11:11:50 +02:00
2014-11-21 09:23:06 -08:00
2014-03-28 16:04:19 -04:00
2012-03-07 15:04:04 -05:00
2012-05-17 15:18:37 +02:00
2014-01-23 16:37:03 -08:00
2013-09-11 15:59:19 -07:00
2014-01-21 23:17:20 -08:00
2013-12-08 17:56:37 -08:00
2012-03-07 15:04:04 -05:00
2014-01-21 16:19:48 -08:00
2013-09-25 14:07:32 +02:00
2009-01-08 08:31:14 -08:00
2012-04-20 23:27:08 +02:00
2013-04-30 17:04:03 -07:00
2014-11-14 08:59:49 -08:00
2012-05-26 11:33:40 -07:00
2012-05-27 20:59:46 -07:00
2014-01-27 21:02:38 -08:00
2012-03-07 15:04:04 -05:00
2014-01-23 16:36:57 -08:00
2014-01-23 16:36:57 -08:00
2012-05-29 16:22:32 -07:00
2013-04-30 17:04:03 -07:00
2011-01-24 23:33:30 -08:00
2012-03-24 10:24:31 -07:00
2008-07-08 02:37:54 -07:00
2008-07-08 02:38:27 -07:00
2008-07-08 02:38:09 -07:00
2013-04-15 21:23:03 +01:00
2013-04-30 17:04:09 -07:00
2013-04-29 18:28:42 -07:00
2014-01-23 16:36:56 -08:00