APPLIED: [SRU][Trusty][CVE-2017-13305][PATCH] KEYS: encrypted: fix buffer overread in valid_master_desc()

[Stefan Bader]

On 19.04.2018 12:33, Kleber Sacilotto de Souza wrote:
> From: Eric Biggers <ebiggers at google.com>
> 
> CVE-2017-13305
> 
> With the 'encrypted' key type it was possible for userspace to provide a
> data blob ending with a master key description shorter than expected,
> e.g. 'keyctl add encrypted desc "new x" @s'.  When validating such a
> master key description, validate_master_desc() could read beyond the end
> of the buffer.  Fix this by using strncmp() instead of memcmp().  [Also
> clean up the code to deduplicate some logic.]
> 
> Cc: Mimi Zohar <zohar at linux.vnet.ibm.com>
> Signed-off-by: Eric Biggers <ebiggers at google.com>
> Signed-off-by: David Howells <dhowells at redhat.com>
> Signed-off-by: James Morris <james.l.morris at oracle.com>
> (cherry picked from commit 794b4bc292f5d31739d89c0202c54e7dc9bc3add)
> Signed-off-by: Kleber Sacilotto de Souza <kleber.souza at canonical.com>
> ---

Applied to trusty/master-next

>  security/keys/encrypted-keys/encrypted.c | 31 +++++++++++++++----------------
>  1 file changed, 15 insertions(+), 16 deletions(-)
> 
> diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
> index c4c8df4b214d..258bd532cbf3 100644
> --- a/security/keys/encrypted-keys/encrypted.c
> +++ b/security/keys/encrypted-keys/encrypted.c
> @@ -141,23 +141,22 @@ static int valid_ecryptfs_desc(const char *ecryptfs_desc)
>   */
>  static int valid_master_desc(const char *new_desc, const char *orig_desc)
>  {
> -	if (!memcmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) {
> -		if (strlen(new_desc) == KEY_TRUSTED_PREFIX_LEN)
> -			goto out;
> -		if (orig_desc)
> -			if (memcmp(new_desc, orig_desc, KEY_TRUSTED_PREFIX_LEN))
> -				goto out;
> -	} else if (!memcmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) {
> -		if (strlen(new_desc) == KEY_USER_PREFIX_LEN)
> -			goto out;
> -		if (orig_desc)
> -			if (memcmp(new_desc, orig_desc, KEY_USER_PREFIX_LEN))
> -				goto out;
> -	} else
> -		goto out;
> +	int prefix_len;
> +
> +	if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
> +		prefix_len = KEY_TRUSTED_PREFIX_LEN;
> +	else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
> +		prefix_len = KEY_USER_PREFIX_LEN;
> +	else
> +		return -EINVAL;
> +
> +	if (!new_desc[prefix_len])
> +		return -EINVAL;
> +
> +	if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
> +		return -EINVAL;
> +
>  	return 0;
> -out:
> -	return -EINVAL;
>  }
>  
>  /*
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20180420/2b0d443f/attachment.sig>