X.509: Fix validation of ASN.1 certificate header
Subsystems (3)
Lukas Wunner
maintainerPATCH 1/1 X.509: Fix validation of ASN.1 certificate header
x509_load_certificate_list() seeks to enforce that a certificate starts with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256 and less than 65535 bytes).
But it only enforces that *either* of those two byte values are present, instead of checking for the *conjunction* of the two values. Fix it.
--- crypto/asymmetric_keys/x509_loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/asymmetric_keys/x509_loader.c +1 -1
@@ -20,7 +20,7 @@ int x509_load_certificate_list(const u8 cert_list[],*/ if (end - p <4 ) goto dodgy_cert; -if (p[0 ] !=0x30 && +if (p[0 ] !=0x30 || p[1 ] !=0x82 ) goto dodgy_cert; plen = (p[2 ] <<8 ) | p[3 ];
Signature · 1 line
2.51.0
Quoted 5 lines · Lukas Wunner
x509_load_certificate_list()seeks to enforce that a certificate starts with0x300x82(ASN.1 SEQUENCE tag followed by a length of more than 256 and less than 65535 bytes).
Quoted 8 lines
But it only enforces that *either* of those two byte values are present, instead of checking for the *conjunction* of the two values. Fix it.
Fixes 631cc66eb9ea ("MODSIGN: Provide module signing public keys to the kernel")Reported-by Sashiko <[email protected]>Signed-off-by Lukas Wunner <[email protected]>Cc [email protected] # v3.7+
Quoted 9 lines
--- crypto/asymmetric_keys/x509_loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)crypto/asymmetric_keys/x509_loader.c +0
-0
crypto/asymmetric_keys/x509_loader.c int x509_load_certificate_list(const u8 cert_list[], · line 23
Quoted 5 lines
crypto/asymmetric_keys/x509_loader.c +1
-1@@ -20,7 +20,7 @@ int x509_load_certificate_list(const u8 cert_list[],*/ if (end - p <4 ) goto dodgy_cert; - if (p[0] != 0x30 && + if (p[0] != 0x30 ||
Whoa! Nice catch...
Quoted 7 lines
crypto/asymmetric_keys/x509_loader.c +0
-1p[1] != 0x82) goto dodgy_cert; plen = (p[2 ] <<8 ) | p[3 ]; --2.51.0
Quoted 5 lines · Lukas Wunner
x509_load_certificate_list()seeks to enforce that a certificate starts with0x300x82(ASN.1 SEQUENCE tag followed by a length of more than 256 and less than 65535 bytes).
Quoted 8 lines
But it only enforces that *either* of those two byte values are present, instead of checking for the *conjunction* of the two values. Fix it.
Fixes 631cc66eb9ea ("MODSIGN: Provide module signing public keys to the kernel")Reported-by Sashiko <[email protected]>Signed-off-by Lukas Wunner <[email protected]>Cc [email protected] # v3.7+
Alistair
Quoted 20 lines
--- crypto/asymmetric_keys/x509_loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)crypto/asymmetric_keys/x509_loader.c +1
-2@@ -20,7 +20,7 @@ int x509_load_certificate_list(const u8 cert_list[],*/ if (end - p <4 ) goto dodgy_cert; -if (p[0 ] !=0x30 && +if (p[0 ] !=0x30 || p[1 ] !=0x82 ) goto dodgy_cert; plen = (p[2 ] <<8 ) | p[3 ]; --2.51.0
Herbert Xu
maintainerQuoted 7 lines · Lukas Wunner
x509_load_certificate_list()seeks to enforce that a certificate starts with0x300x82(ASN.1 SEQUENCE tag followed by a length of more than 256 and less than 65535 bytes).But it only enforces that *either* of those two byte values are present, instead of checking for the *conjunction* of the two values. Fix it.
Quoted 8 lines
Fixes 631cc66eb9ea ("MODSIGN: Provide module signing public keys to the kernel")Reported-by Sashiko <[email protected]>Signed-off-by Lukas Wunner <[email protected]>Cc [email protected] # v3.7+--- crypto/asymmetric_keys/x509_loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Patch applied. Thanks.
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt