From: David Howells <dhowells@redhat.com>
To: linux-security-module@vger.kernel.org
Subject: [PATCH 01/15] KEYS: encrypted: fix dereference of NULL user_key_payload
Date: Thu, 12 Oct 2017 20:16:03 +0000 [thread overview]
Message-ID: <150783936328.10956.1529578849513896883.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <150783935268.10956.14343227057986655899.stgit@warthog.procyon.org.uk>
From: Eric Biggers <ebiggers@google.com>
A key of type "encrypted" references a "master key" which is used to
encrypt and decrypt the encrypted key's payload. However, when we
accessed the master key's payload, we failed to handle the case where
the master key has been revoked, which sets the payload pointer to NULL.
Note that request_key() *does* skip revoked keys, but there is still a
window where the key can be revoked before we acquire its semaphore.
Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.
This was an issue for master keys of type "user" only. Master keys can
also be of type "trusted", but those cannot be revoked.
Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: <stable@vger.kernel.org> [v2.6.38+]
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: David Safford <safford@us.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---
security/keys/encrypted-keys/encrypted.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 69855ba0d3b3..535db141f4da 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -309,6 +309,13 @@ static struct key *request_user_key(const char *master_desc, const u8 **master_k
down_read(&ukey->sem);
upayload = user_key_payload_locked(ukey);
+ if (!upayload) {
+ /* key was revoked before we acquired its semaphore */
+ up_read(&ukey->sem);
+ key_put(ukey);
+ ukey = ERR_PTR(-EKEYREVOKED);
+ goto error;
+ }
*master_key = upayload->data;
*master_keylen = upayload->datalen;
error:
WARNING: multiple messages have this Message-ID (diff)
From: David Howells <dhowells@redhat.com>
To: ebiggers@google.com
Cc: keyrings@vger.kernel.org, dhowells@redhat.com,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Mimi Zohar <zohar@linux.vnet.ibm.com>,
David Safford <safford@us.ibm.com>
Subject: [PATCH 01/15] KEYS: encrypted: fix dereference of NULL user_key_payload
Date: Thu, 12 Oct 2017 21:16:03 +0100 [thread overview]
Message-ID: <150783936328.10956.1529578849513896883.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <150783935268.10956.14343227057986655899.stgit@warthog.procyon.org.uk>
From: Eric Biggers <ebiggers@google.com>
A key of type "encrypted" references a "master key" which is used to
encrypt and decrypt the encrypted key's payload. However, when we
accessed the master key's payload, we failed to handle the case where
the master key has been revoked, which sets the payload pointer to NULL.
Note that request_key() *does* skip revoked keys, but there is still a
window where the key can be revoked before we acquire its semaphore.
Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.
This was an issue for master keys of type "user" only. Master keys can
also be of type "trusted", but those cannot be revoked.
Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: <stable@vger.kernel.org> [v2.6.38+]
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: David Safford <safford@us.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---
security/keys/encrypted-keys/encrypted.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 69855ba0d3b3..535db141f4da 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -309,6 +309,13 @@ static struct key *request_user_key(const char *master_desc, const u8 **master_k
down_read(&ukey->sem);
upayload = user_key_payload_locked(ukey);
+ if (!upayload) {
+ /* key was revoked before we acquired its semaphore */
+ up_read(&ukey->sem);
+ key_put(ukey);
+ ukey = ERR_PTR(-EKEYREVOKED);
+ goto error;
+ }
*master_key = upayload->data;
*master_keylen = upayload->datalen;
error:
WARNING: multiple messages have this Message-ID (diff)
From: dhowells@redhat.com (David Howells)
To: linux-security-module@vger.kernel.org
Subject: [PATCH 01/15] KEYS: encrypted: fix dereference of NULL user_key_payload
Date: Thu, 12 Oct 2017 21:16:03 +0100 [thread overview]
Message-ID: <150783936328.10956.1529578849513896883.stgit@warthog.procyon.org.uk> (raw)
In-Reply-To: <150783935268.10956.14343227057986655899.stgit@warthog.procyon.org.uk>
From: Eric Biggers <ebiggers@google.com>
A key of type "encrypted" references a "master key" which is used to
encrypt and decrypt the encrypted key's payload. However, when we
accessed the master key's payload, we failed to handle the case where
the master key has been revoked, which sets the payload pointer to NULL.
Note that request_key() *does* skip revoked keys, but there is still a
window where the key can be revoked before we acquire its semaphore.
Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.
This was an issue for master keys of type "user" only. Master keys can
also be of type "trusted", but those cannot be revoked.
Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: <stable@vger.kernel.org> [v2.6.38+]
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: David Safford <safford@us.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---
security/keys/encrypted-keys/encrypted.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 69855ba0d3b3..535db141f4da 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -309,6 +309,13 @@ static struct key *request_user_key(const char *master_desc, const u8 **master_k
down_read(&ukey->sem);
upayload = user_key_payload_locked(ukey);
+ if (!upayload) {
+ /* key was revoked before we acquired its semaphore */
+ up_read(&ukey->sem);
+ key_put(ukey);
+ ukey = ERR_PTR(-EKEYREVOKED);
+ goto error;
+ }
*master_key = upayload->data;
*master_keylen = upayload->datalen;
error:
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2017-10-12 20:16 UTC|newest]
Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-12 16:17 [RFC][PATCH 00/15] KEYS: Fixes David Howells
2017-10-12 16:17 ` David Howells
2017-10-12 16:17 ` David Howells
2017-10-12 16:26 ` David Howells
2017-10-12 16:26 ` David Howells
2017-10-12 16:26 ` David Howells
2017-10-12 18:56 ` Eric Biggers
2017-10-12 18:56 ` Eric Biggers
2017-10-12 18:56 ` Eric Biggers
2017-10-12 20:15 ` David Howells
2017-10-12 20:15 ` David Howells
2017-10-12 20:15 ` David Howells
2017-10-12 20:16 ` David Howells [this message]
2017-10-12 20:16 ` [PATCH 01/15] KEYS: encrypted: fix dereference of NULL user_key_payload David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` [PATCH 02/15] FS-Cache: " David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` [PATCH 03/15] lib/digsig: " David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` [PATCH 04/15] fscrypt: " David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` [PATCH 05/15] ecryptfs: " David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` [PATCH 06/15] ecryptfs: fix out-of-bounds read of key payload David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` [PATCH 07/15] ecryptfs: move key payload accessor functions into keystore.c David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` [PATCH 08/15] security/keys: BIG_KEY requires CONFIG_CRYPTO David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:16 ` David Howells
2017-10-12 20:17 ` [PATCH 09/15] KEYS: Fix the wrong index when checking the existence of second id David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` [PATCH 10/15] KEYS: checking the input id parameters before finding asymmetric key David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` [PATCH 11/15] KEYS: Fix race between updating and finding a negative key David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` [PATCH 12/15] KEYS: don't let add_key() update an uninstantiated key David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` [PATCH 13/15] KEYS: load key flags and expiry time atomically in key_validate() David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` [PATCH 14/15] KEYS: load key flags and expiry time atomically in keyring_search_iterator() David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` [PATCH 15/15] KEYS: load key flags and expiry time atomically in proc_keys_show() David Howells
2017-10-12 20:17 ` David Howells
2017-10-12 20:17 ` David Howells
2017-10-13 15:39 ` [RFC][PATCH 00/15] KEYS: Fixes David Howells
2017-10-13 15:39 ` David Howells
2017-10-13 15:39 ` David Howells
2017-10-16 18:31 ` Eric Biggers
2017-10-16 18:31 ` Eric Biggers
2017-10-16 18:31 ` Eric Biggers
2017-10-16 22:09 ` David Howells
2017-10-16 22:09 ` David Howells
2017-10-16 22:09 ` David Howells
2017-10-16 22:27 ` David Howells
2017-10-16 22:27 ` David Howells
2017-10-16 22:27 ` David Howells
2017-10-17 17:52 ` Eric Biggers
2017-10-17 17:52 ` Eric Biggers
2017-10-17 17:52 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=150783936328.10956.1529578849513896883.stgit@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.