Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3619dec5 authored by Eric Biggers's avatar Eric Biggers Committed by James Morris
Browse files

dh key: fix rounding up KDF output length 



Commit 383203ef ("dh key: get rid of stack allocated array") changed
kdf_ctr() to assume that the length of key material to derive is a
multiple of the digest size.  The length was supposed to be rounded up
accordingly.  However, the round_up() macro was used which only gives
the correct result on power-of-2 arguments, whereas not all hash
algorithms have power-of-2 digest sizes.  In some cases this resulted in
a write past the end of the 'outbuf' buffer.

Fix it by switching to roundup(), which works for non-power-of-2 inputs.

Reported-by: default avatar <syzbot+486f97f892efeb2075a3@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+29d17b7898b41ee120a5@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+8a608baf8751184ec727@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+d04e58bd384f1fe0b112@syzkaller.appspotmail.com>
Fixes: 383203ef ("dh key: get rid of stack allocated array")
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarTycho Andersen <tycho@tycho.ws>
Signed-off-by: default avatarJames Morris <james.morris@microsoft.com>
parent 2e20ce4a

security/keys/dh.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -142,6 +142,8 @@ static void kdf_dealloc(struct kdf_sdesc *sdesc) 
 * The src pointer is defined as Z || other info where Z is the shared secret

 * The src pointer is defined as Z || other info where Z is the shared secret

 * from DH and other info is an arbitrary string (see SP800-56A section

 * from DH and other info is an arbitrary string (see SP800-56A section

 * 5.8.1.2).

 * 5.8.1.2).

 *

 * 'dlen' must be a multiple of the digest size.

 */

 */

static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,

static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,

		   u8 *dst, unsigned int dlen, unsigned int zlen)

		   u8 *dst, unsigned int dlen, unsigned int zlen)
@@ -205,7 +207,7 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc, 
{

{

	uint8_t *outbuf = NULL;

	uint8_t *outbuf = NULL;

	int ret;

	int ret;

	size_t outbuf_len = round_up(buflen,

	size_t outbuf_len = roundup(buflen,

				    crypto_shash_digestsize(sdesc->shash.tfm));

				    crypto_shash_digestsize(sdesc->shash.tfm));





	outbuf = kmalloc(outbuf_len, GFP_KERNEL);

	outbuf = kmalloc(outbuf_len, GFP_KERNEL);