NACK: [SRU][N][PATCH 1/1] s390/zcrypt: Validate length for CCA ECC private key requests

[Andrei Gherzan]

On 26/09/11 04:39AM, Cengiz Can via kernel-team wrote:
> From: Holger Dengler <dengler at linux.ibm.com>
> 
> cca_ecc2protkey() derives the copy length for the CPRB parameter
> block directly from the length field in the key token. Reject the
> request early if the token length exceeds the available space in the
> parameter block.
> 
> Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys")
> Signed-off-by: Holger Dengler <dengler at linux.ibm.com>
> Cc: stable at vger.kernel.org # 5.10+
> Reviewed-by: Harald Freudenberger <freude at linux.ibm.com>
> Signed-off-by: Vasily Gorbik <gor at linux.ibm.com>
> (backported from commit a9ae0f6dd45c3ccc1d69363f7aea8af179122730)
> [bot_kybele: backported to noble/linux; review and refine this note]

Generic backport comment.

> CVE-2026-68451
> Assisted-by: kybele:claude-opus-4.8
> Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
> ---
>  drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
> index a22ad1bc3a43..e9254dececf7 100644
> --- a/drivers/s390/crypto/zcrypt_ccamisc.c
> +++ b/drivers/s390/crypto/zcrypt_ccamisc.c
> @@ -1381,6 +1381,9 @@ int cca_ecc2protkey(u16 cardnr, u16 domain, const u8 *key,
>  	} __packed * prepparm;
>  	int keylen = ((struct eccprivkeytoken *)key)->len;
>  
> +	if (keylen > PARMBSIZE - sizeof(struct aureqparm))
> +		return -EINVAL;
> +
>  	/* get already prepared memory for 2 cprbs with param block each */
>  	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem, &preqcblk, &prepcblk);
>  	if (rc)
> -- 
> 2.53.0
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/bd1c2960/attachment.sig>