Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S940997AbcKXNAh (ORCPT ); Thu, 24 Nov 2016 08:00:37 -0500 Received: from mail-lf0-f66.google.com ([209.85.215.66]:33220 "EHLO mail-lf0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756781AbcKXNAf (ORCPT ); Thu, 24 Nov 2016 08:00:35 -0500 Subject: Re: [PATCH 2/2] MPI: Fix mpi_powm() when exponent is 0 and the result has no limbs To: David Howells References: <8467.1479992169@warthog.procyon.org.uk> <147997746306.9316.227351186233378585.stgit@warthog.procyon.org.uk> <147997747766.9316.11606802798600210253.stgit@warthog.procyon.org.uk> <5323.1479986239@warthog.procyon.org.uk> <5807.1479987214@warthog.procyon.org.uk> <8731.1479992261@warthog.procyon.org.uk> Cc: jmorris@namei.org, Dmitry Kasatkin , LKML , stable@vger.kernel.org, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-ima-devel@lists.sourceforge.net From: Andrey Ryabinin Message-ID: <70fb2f30-e5b8-fa82-00ef-bcb1effb6888@gmail.com> Date: Thu, 24 Nov 2016 16:00:59 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <8731.1479992261@warthog.procyon.org.uk> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4816 Lines: 110 On 11/24/2016 03:57 PM, David Howells wrote: > David Howells wrote: > >> I've integrated my patch and yours (see attached) - are you okay with the >> result? > > It helps if I commit the changes... > Looks good, thanks. > David > --- > commit 1dc938c3393d8ff0e04723956ed00ec21e2b2a89 > Author: Andrey Ryabinin > Date: Wed Nov 23 16:44:47 2016 +0000 > > mpi: Fix NULL ptr dereference in mpi_powm() > > This fixes CVE-2016-8650. > > If mpi_powm() is given a zero exponent, it wants to immediately return > either 1 or 0, depending on the modulus. However, if the result was > initalised with zero limb space, no limbs space is allocated and a > NULL-pointer exception ensues. > > Fix this by allocating a minimal amount of limb space for the result when > the 0-exponent case when the result is 1 and not touching the limb space > when the result is 0. > > This affects the use of RSA keys and X.509 certificates that carry them. > > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: [] mpi_powm+0x32/0x7e6 > PGD 0 > Oops: 0002 [#1] SMP > Modules linked in: > CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278 > Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 > task: ffff8804011944c0 task.stack: ffff880401294000 > RIP: 0010:[] [] mpi_powm+0x32/0x7e6 > RSP: 0018:ffff880401297ad8 EFLAGS: 00010212 > RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0 > RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0 > RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000 > R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50 > FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0 > Stack: > ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4 > 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30 > ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8 > Call Trace: > [] ? __sg_page_iter_next+0x43/0x66 > [] ? sg_miter_get_next_page+0x1b/0x5d > [] ? sg_miter_next+0x17/0xbd > [] ? mpi_read_raw_from_sgl+0xf2/0x146 > [] rsa_verify+0x9d/0xee > [] ? pkcs1pad_sg_set_buf+0x2e/0xbb > [] pkcs1pad_verify+0xc0/0xe1 > [] public_key_verify_signature+0x1b0/0x228 > [] x509_check_for_self_signed+0xa1/0xc4 > [] x509_cert_parse+0x167/0x1a1 > [] x509_key_preparse+0x21/0x1a1 > [] asymmetric_key_preparse+0x34/0x61 > [] key_create_or_update+0x145/0x399 > [] SyS_add_key+0x154/0x19e > [] do_syscall_64+0x80/0x191 > [] entry_SYSCALL64_slow_path+0x25/0x25 > Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f > RIP [] mpi_powm+0x32/0x7e6 > RSP > CR2: 0000000000000000 > ---[ end trace d82015255d4a5d8d ]--- > > Basically, this is a backport of a libgcrypt patch: > > http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526 > > Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)") > Signed-off-by: Andrey Ryabinin > Signed-off-by: David Howells > cc: Dmitry Kasatkin > cc: linux-ima-devel@lists.sourceforge.net > cc: stable@vger.kernel.org > > diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c > index 5464c8744ea9..e24388a863a7 100644 > --- a/lib/mpi/mpi-pow.c > +++ b/lib/mpi/mpi-pow.c > @@ -64,8 +64,13 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) > if (!esize) { > /* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0 > * depending on if MOD equals 1. */ > - rp[0] = 1; > res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1; > + if (res->nlimbs) { > + if (mpi_resize(res, 1) < 0) > + goto enomem; > + rp = res->d; > + rp[0] = 1; > + } > res->sign = 0; > goto leave; > } >