Eric Biggers 47e8bd1965 KEYS: fix writing past end of user-supplied buffer in keyring_read() ...

commit e645016abc upstream.

Userspace can call keyctl_read() on a keyring to get the list of IDs of
keys in the keyring.  But if the user-supplied buffer is too small, the
kernel would write the full list anyway --- which will corrupt whatever
userspace memory happened to be past the end of the buffer.  Fix it by
only filling the space that is available.

Fixes: b2a4df200d ("KEYS: Expand the capacity of a keyring")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-10-05 09:44:00 +02:00

..

encrypted-keys

KEYS: Fix an error code in request_master_key()

2017-07-12 15:01:06 +02:00

big_key.c

security/keys: rewrite all of big_key crypto

2017-10-05 09:44:00 +02:00

compat.c

KEYS: Add placeholder for KDF usage with DH

2016-06-03 16:14:34 +10:00

dh.c

KEYS: Add placeholder for KDF usage with DH

2016-06-03 16:14:34 +10:00

gc.c

KEYS: Change the name of the dead type to ".dead" to prevent user access

2017-04-27 09:10:37 +02:00

internal.h

KEYS: Add placeholder for KDF usage with DH

2016-06-03 16:14:34 +10:00

Kconfig

security/keys: rewrite all of big_key crypto

2017-10-05 09:44:00 +02:00

key.c

KEYS: fix freeing uninitialized memory in key_update()

2017-06-14 15:05:54 +02:00

keyctl.c

KEYS: fix dereferencing NULL payload with nonzero length

2017-06-14 15:05:54 +02:00

keyring.c

KEYS: fix writing past end of user-supplied buffer in keyring_read()

2017-10-05 09:44:00 +02:00

Makefile

KEYS: Add KEYCTL_DH_COMPUTE command

2016-04-12 19:54:58 +01:00

permission.c

KEYS: Move the flags representing required permission to linux/key.h

2014-03-14 17:44:49 +00:00

persistent.c

KEYS: Strip trailing spaces

2016-06-14 10:29:44 +01:00

proc.c

KEYS: Fix short sprintf buffer in /proc/keys show function

2016-10-27 16:03:24 +11:00

process_keys.c

KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings

2017-04-27 09:10:37 +02:00

request_key_auth.c

KEYS: Add a facility to restrict new links into a keyring

2016-04-11 22:37:37 +01:00

request_key.c

KEYS: Strip trailing spaces

2016-06-14 10:29:44 +01:00

sysctl.c

security: Convert use of typedef ctl_table to struct ctl_table

2014-04-15 13:39:58 +10:00

trusted.c

tpm: fix checks for policy digest existence in tpm2_seal_trusted()

2016-02-10 04:10:55 +02:00

trusted.h

keys, trusted: move struct trusted_key_options to trusted-type.h

2015-10-19 01:01:21 +02:00

user_defined.c

KEYS: user_update should use copy of payload made during preparsing

2016-04-12 19:54:58 +01:00