All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Mickaël Salaün" <mic@digikod.net>
To: David Howells <dhowells@redhat.com>,
	David Woodhouse <dwmw2@infradead.org>,
	Jarkko Sakkinen <jarkko@kernel.org>
Cc: "Mickaël Salaün" <mic@digikod.net>,
	"David S . Miller" <davem@davemloft.net>,
	"Herbert Xu" <herbert@gondor.apana.org.au>,
	"James Morris" <jmorris@namei.org>,
	"Mickaël Salaün" <mic@linux.microsoft.com>,
	"Mimi Zohar" <zohar@linux.ibm.com>,
	"Serge E . Hallyn" <serge@hallyn.com>,
	keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
	linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	"Ben Boeckel" <mathstuf@gmail.com>
Subject: [PATCH v3 02/10] certs: Fix blacklisted hexadecimal hash string check
Date: Thu, 14 Jan 2021 16:19:01 +0100	[thread overview]
Message-ID: <20210114151909.2344974-3-mic@digikod.net> (raw)
In-Reply-To: <20210114151909.2344974-1-mic@digikod.net>

From: Mickaël Salaün <mic@linux.microsoft.com>

When looking for a blacklisted hash, bin2hex() is used to transform a
binary hash to an ascii (lowercase) hexadecimal string.  This string is
then search for in the description of the keys from the blacklist
keyring.  When adding a key to the blacklist keyring,
blacklist_vet_description() checks the hash prefix and the hexadecimal
string, but not that this string is lowercase.  It is then valid to set
hashes with uppercase hexadecimal, which will be silently ignored by the
kernel.

Add an additional check to blacklist_vet_description() to check that
hexadecimal strings are in lowercase.

Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Ben Boeckel <mathstuf@gmail.com>
---

Changes since v2:
* Cherry-pick v1 patch from
  https://lore.kernel.org/lkml/2659836.1607940186@warthog.procyon.org.uk/
  to rebase on v5.11-rc3.
* Rearrange Cc order.
---
 certs/blacklist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/certs/blacklist.c b/certs/blacklist.c
index 2719fb2fbc1c..a888b934a1cd 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -37,7 +37,7 @@ static int blacklist_vet_description(const char *desc)
 found_colon:
 	desc++;
 	for (; *desc; desc++) {
-		if (!isxdigit(*desc))
+		if (!isxdigit(*desc) || isupper(*desc))
 			return -EINVAL;
 		n++;
 	}
-- 
2.30.0


  parent reply	other threads:[~2021-01-14 15:20 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-14 15:18 [PATCH v3 00/10] Enable root to update the blacklist keyring Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 01/10] certs/blacklist: fix kernel doc interface issue Mickaël Salaün
2021-01-20  3:39   ` Jarkko Sakkinen
2021-01-14 15:19 ` Mickaël Salaün [this message]
2021-01-20  3:43   ` [PATCH v3 02/10] certs: Fix blacklisted hexadecimal hash string check Jarkko Sakkinen
2021-01-20 11:12     ` Mickaël Salaün
2021-01-20 23:44       ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 03/10] PKCS#7: Fix missing include Mickaël Salaün
2021-01-20  3:44   ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 04/10] certs: Fix blacklist flag type confusion Mickaël Salaün
2021-01-20  3:55   ` Jarkko Sakkinen
2021-01-20 11:15     ` Mickaël Salaün
2021-01-20 23:45       ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 05/10] certs: Replace K{U,G}IDT_INIT() with GLOBAL_ROOT_{U,G}ID Mickaël Salaün
2021-01-20  5:15   ` Jarkko Sakkinen
2021-01-20 11:17     ` Mickaël Salaün
2021-01-20 23:48       ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 06/10] certs: Make blacklist_vet_description() more strict Mickaël Salaün
2021-01-20  4:16   ` Jarkko Sakkinen
2021-01-20 11:23     ` Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 07/10] certs: Factor out the blacklist hash creation Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 08/10] certs: Check that builtin blacklist hashes are valid Mickaël Salaün
2021-01-20  5:19   ` Jarkko Sakkinen
2021-01-20 11:57     ` Mickaël Salaün
2021-01-20 23:53       ` Jarkko Sakkinen
2021-01-21  9:18         ` Mickaël Salaün
2021-01-21 15:21           ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 09/10] certs: Allow root user to append signed hashes to the blacklist keyring Mickaël Salaün
2021-01-15 13:06   ` Mimi Zohar
2021-01-20  5:23   ` Jarkko Sakkinen
2021-01-20 11:24     ` Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 10/10] tools/certs: Add print-cert-tbs-hash.sh Mickaël Salaün
2021-01-15  9:28 ` [PATCH v3 00/10] Enable root to update the blacklist keyring Jarkko Sakkinen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210114151909.2344974-3-mic@digikod.net \
    --to=mic@digikod.net \
    --cc=davem@davemloft.net \
    --cc=dhowells@redhat.com \
    --cc=dwmw2@infradead.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=jarkko@kernel.org \
    --cc=jmorris@namei.org \
    --cc=keyrings@vger.kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mathstuf@gmail.com \
    --cc=mic@linux.microsoft.com \
    --cc=serge@hallyn.com \
    --cc=zohar@linux.ibm.com \
    --subject='Re: [PATCH v3 02/10] certs: Fix blacklisted hexadecimal hash string check' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.