Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 801863f6 authored by Roberto Sassu's avatar Roberto Sassu Committed by Greg Kroah-Hartman
Browse files

evm: Check size of security.evm before using it 



commit 455b6c9112eff8d249e32ba165742085678a80a4 upstream.

This patch checks the size for the EVM_IMA_XATTR_DIGSIG and
EVM_XATTR_PORTABLE_DIGSIG types to ensure that the algorithm is read from
the buffer returned by vfs_getxattr_alloc().

Cc: stable@vger.kernel.org # 4.19.x
Fixes: 5feeb611 ("evm: Allow non-SHA1 digital signatures")
Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent dd2f800e

security/integrity/evm/evm_main.c

+6 −0
Original line number Diff line number Diff line
@@ -183,6 +183,12 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, 
		break;

	case EVM_IMA_XATTR_DIGSIG:

	case EVM_XATTR_PORTABLE_DIGSIG:

		/* accept xattr with non-empty signature field */

		if (xattr_len <= sizeof(struct signature_v2_hdr)) {

			evm_status = INTEGRITY_FAIL;

			goto out;

		}



		hdr = (struct signature_v2_hdr *)xattr_data;

		digest.hdr.algo = hdr->hash_algo;

		rc = evm_calc_hash(dentry, xattr_name, xattr_value,