crypto: dh - input validation fixes
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest5 patches 4 repliesIn review
- v14 patches 6 repliesSuperseded
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | crypto: dh - Fix double free of ctx->pcrypto/ | +13 | 1 reply | |
| 2/5 | crypto: dh - Don't permit 'p' to be 0crypto/ | +8 | 0 replies | |
| 3/5 | crypto: dh - Don't permit 'key' or 'g' size longer than 'p'crypto/ | +8 | 1 reply | |
| 4/5 | crypto: qat - Clean up error handling in qat_dh_set_secret()drivers/ | +8 | 0 replies | |
| 5/5 | crypto: dh - Remove pointless checks for NULL 'p' and 'g'crypto/ drivers/ | +0 | 1 reply |
Reviews trailers per patch
4 of 5 patches have a Reviewed-by or Acked-by.
| Patch | Tudor Ambarus |
|---|---|
| 1/5 | R-b |
| 2/5 | R-b |
| 3/5 | R-b |
| 4/5 | |
| 5/5 | R-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v2 0/5] crypto: dh - input validation fixes
This series fixes several corner cases in the Diffie-Hellman key exchange implementations:
1. With the software DH implementation, using a large buffer for 'g' caused a double free.
2. With CONFIG_DEBUG_SG=y and the software DH implementation, setting 'p' to 0 caused a BUG_ON().
3. With the QAT DH implementation, setting 'key' or 'g' larger than 'p' caused a buffer underflow.
Note that in kernels configured with CONFIG_KEY_DH_OPERATIONS=y, these bugs are reachable by unprivileged users via KEYCTL_DH_COMPUTE.
Patches 4 and 5 are cleanup only.
Eric Biggers (5):
crypto: dh - Fix double free of ctx->p
crypto: dh - Don't permit 'p' to be 0
crypto: dh - Don't permit 'key' or 'g' size longer than 'p'
crypto: qat - Clean up error handling in qat_dh_set_secret()
crypto: dh - Remove pointless checks for NULL 'p' and 'g'
crypto/dh.c | 36 ++++++++++----------------- crypto/dh_helper.c | 16 ++++++++++++ drivers/crypto/qat/qat_common/qat_asym_algs.c | 18 ++++++-------- 3 files changed, 37 insertions(+), 33 deletions(-)
Signature · 1 line
2.15.0