Received: by 10.223.185.116 with SMTP id b49csp4169556wrg; Mon, 26 Feb 2018 12:28:01 -0800 (PST) X-Google-Smtp-Source: AH8x225VJO38OsJ4oLRtfMY2v8vmLj+Cxzbx0sc1mpBC3eSTHPcmOfNHt/cxu3mZcnHnNIQAkKqa X-Received: by 10.99.114.80 with SMTP id c16mr9378776pgn.436.1519676881025; Mon, 26 Feb 2018 12:28:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519676880; cv=none; d=google.com; s=arc-20160816; b=UpYN9q6CtHlO5XOMeUW4U+o3XFxSqH8eyuWrJgEKvUhkLNqFJfIturHlIh6F4/+KmY 8Kav1Z69Rx1pY8KqScxSep/KQei/yYANnkGe//ebqleuX5ARanNCW4sTCU/CRCCdg3tX kQksV1qqL6EbqKSeU0jtbTYuJBYFwieGnFPEA6bcYqSfZ9G/5YxVC3mGZgEsg4Ce0i87 1F5Mqsc3WeA6ROnmCRudzKOwHWVLsdlae4Ufq6mG6dZ53x8pM89vO/O4W7GbsnM9Du0W SYiHOOSnJJXGSuU+p0uMM8QkIbSLfKUrdE8R2Wrq2O0UHeN3OQPfZ/7XoP8zBTX0Uubp dK7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=4AQMnCr2waf20oaeK3AyCqVCPqGMX00vnFrEzPf/tDI=; b=HE51kh/5AtGmNznzYzWGar/Cvl5l4DHQ4c7TRBH7gMT0+srxt329z2eXVHV2FS8GTB USN0GEshq3RX669Ou5H6IVLhZNR3j6aSUBKb/MwG/S2bymv0oYWJSdpyFrW3bBUykUn3 Pdz1PqVO1OPvZ3RYAy2BMy2Kvc09yQcYOz97KIETzj0LOgDj5nApGIosRQ3zefNwGbEG iRztP5MfOQeFS+kqyOgnyrcMPN+304VWbSZ2dqB6lIx3YuJX7q4svAW9lR8FiU8M8qC7 Ezi5b3QDDx/DrAiO+3f+q0PMcXy0k1STzysLxEcMr/xbZRyG3vpS4EY0VLhICtJlII0X IzPw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b3si5909054pga.503.2018.02.26.12.27.45; Mon, 26 Feb 2018 12:28:00 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753354AbeBZU0R (ORCPT + 99 others); Mon, 26 Feb 2018 15:26:17 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:35668 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753340AbeBZU0O (ORCPT ); Mon, 26 Feb 2018 15:26:14 -0500 Received: from localhost (clnet-b04-243.ikbnet.co.at [83.175.124.243]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 12B3FFFC; Mon, 26 Feb 2018 20:26:12 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers , David Howells Subject: [PATCH 4.15 12/64] X.509: fix NULL dereference when restricting key with unsupported_sig Date: Mon, 26 Feb 2018 21:21:49 +0100 Message-Id: <20180226202153.962932820@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180226202153.453363333@linuxfoundation.org> References: <20180226202153.453363333@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Biggers commit 4b34968e77ad09628cfb3c4a7daf2adc2cefc6e8 upstream. The asymmetric key type allows an X.509 certificate to be added even if its signature's hash algorithm is not available in the crypto API. In that case 'payload.data[asym_auth]' will be NULL. But the key restriction code failed to check for this case before trying to use the signature, resulting in a NULL pointer dereference in key_or_keyring_common() or in restrict_link_by_signature(). Fix this by returning -ENOPKG when the signature is unsupported. Reproducer when all the CONFIG_CRYPTO_SHA512* options are disabled and keyctl has support for the 'restrict_keyring' command: keyctl new_session keyctl restrict_keyring @s asymmetric builtin_trusted openssl req -new -sha512 -x509 -batch -nodes -outform der \ | keyctl padd asymmetric desc @s Fixes: a511e1af8b12 ("KEYS: Move the point of trust determination to __key_link()") Cc: # v4.7+ Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: Greg Kroah-Hartman --- crypto/asymmetric_keys/restrict.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) --- a/crypto/asymmetric_keys/restrict.c +++ b/crypto/asymmetric_keys/restrict.c @@ -67,8 +67,9 @@ __setup("ca_keys=", ca_keys_setup); * * Returns 0 if the new certificate was accepted, -ENOKEY if we couldn't find a * matching parent certificate in the trusted list, -EKEYREJECTED if the - * signature check fails or the key is blacklisted and some other error if - * there is a matching certificate but the signature check cannot be performed. + * signature check fails or the key is blacklisted, -ENOPKG if the signature + * uses unsupported crypto, or some other error if there is a matching + * certificate but the signature check cannot be performed. */ int restrict_link_by_signature(struct key *dest_keyring, const struct key_type *type, @@ -88,6 +89,8 @@ int restrict_link_by_signature(struct ke return -EOPNOTSUPP; sig = payload->data[asym_auth]; + if (!sig) + return -ENOPKG; if (!sig->auth_ids[0] && !sig->auth_ids[1]) return -ENOKEY; @@ -139,6 +142,8 @@ static int key_or_keyring_common(struct return -EOPNOTSUPP; sig = payload->data[asym_auth]; + if (!sig) + return -ENOPKG; if (!sig->auth_ids[0] && !sig->auth_ids[1]) return -ENOKEY; @@ -222,9 +227,9 @@ static int key_or_keyring_common(struct * * Returns 0 if the new certificate was accepted, -ENOKEY if we * couldn't find a matching parent certificate in the trusted list, - * -EKEYREJECTED if the signature check fails, and some other error if - * there is a matching certificate but the signature check cannot be - * performed. + * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses + * unsupported crypto, or some other error if there is a matching certificate + * but the signature check cannot be performed. */ int restrict_link_by_key_or_keyring(struct key *dest_keyring, const struct key_type *type, @@ -249,9 +254,9 @@ int restrict_link_by_key_or_keyring(stru * * Returns 0 if the new certificate was accepted, -ENOKEY if we * couldn't find a matching parent certificate in the trusted list, - * -EKEYREJECTED if the signature check fails, and some other error if - * there is a matching certificate but the signature check cannot be - * performed. + * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses + * unsupported crypto, or some other error if there is a matching certificate + * but the signature check cannot be performed. */ int restrict_link_by_key_or_keyring_chain(struct key *dest_keyring, const struct key_type *type,