[B/linux-aws][SRU][PATCH 0/1] crypto: authenc - fix parsing key with misaligned rta_len

[Stefan Bader]

On 19.08.19 09:36, Po-Hsu Lin wrote:
> BugLink: https://bugs.launchpad.net/bugs/1829725
> 
> This patch has landed on generic kernels, but not the AWS kernel.
> Modify the Test section in the cover letter for AWS and re-submit.
> 
> == Justification ==
> From the commit message:
> Keys for "authenc" AEADs are formatted as an rtattr containing a 4-byte
> 'enckeylen', followed by an authentication key and an encryption key.
> crypto_authenc_extractkeys() parses the key to find the inner keys.
> 
> However, it fails to consider the case where the rtattr's payload is
> longer than 4 bytes but not 4-byte aligned, and where the key ends
> before the next 4-byte aligned boundary.  In this case, 'keylen -=
> RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX.  This
> causes a buffer overread and crash during crypto_ahash_setkey().
> 
> This error can be easily reproduced with the af_alg06 test in LTP test
> suite. (Basically it's the reproducer in the commit message)
> 
> == Fix ==
> 8f9c4693 (crypto: authenc - fix parsing key with misaligned rta_len)
> This patch can be cherry-picked into B/C, and it's already in X/D/E.
> 
> == Test ==
> Test kernels could be found here:
> https://people.canonical.com/~phlin/kernel/lp-1829725-afalg06/B-aws
> 
> Verified on an AWS instance, this issue will no longer exist.
> 
> == Regression potential ==
> Low, this patch just improves the checking for rtattr payload size to
> make sure it's the expected size. Also It has been upstream since 2018
> Dec. and applied in some of our kernels. No subsequent bug report was
> filed against it.
> 
> 
> Eric Biggers (1):
>   crypto: authenc - fix parsing key with misaligned rta_len
> 
>  crypto/authenc.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
> 
That would be because the AWS kernels were not rebased for the last release(s).
But they should have this cycle. Could you double check this really is still
needed and if not self-nack? Thanks.

-Stefan


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20190826/676ca397/attachment.sig>