From: James Morris <james.l.morris@oracle.com>
To: linux-security-module@vger.kernel.org
Subject: Re: [PATCH] KEYS: trusted: fix writing past end of buffer in trusted_read()
Date: Fri, 27 Oct 2017 07:55:39 +0000 [thread overview]
Message-ID: <alpine.LFD.2.20.1710270954210.2635@localhost> (raw)
In-Reply-To: <20171026205744.105566-1-ebiggers3@gmail.com>
On Thu, 26 Oct 2017, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> When calling keyctl_read() on a key of type "trusted", if the
> user-supplied buffer was too small, the kernel ignored the buffer length
> and just wrote past the end of the buffer, potentially corrupting
> userspace memory. Fix it by instead returning the size required, as per
> the documentation for keyctl_read().
>
> We also don't even fill the buffer at all in this case, as this is
> slightly easier to implement than doing a short read, and either
> behavior appears to be permitted. It also makes it match the behavior
> of the "encrypted" key type.
>
> Fixes: d00a1c72f7f4 ("keys: add new trusted key-type")
> Reported-by: Ben Hutchings <ben@decadent.org.uk>
> Cc: <stable@vger.kernel.org> # v2.6.38+
> Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
--
James Morris
<james.l.morris@oracle.com>
WARNING: multiple messages have this Message-ID (diff)
From: James Morris <james.l.morris@oracle.com>
To: Eric Biggers <ebiggers3@gmail.com>
Cc: keyrings@vger.kernel.org, David Howells <dhowells@redhat.com>,
Ben Hutchings <ben@decadent.org.uk>,
Xiao Yang <yangx.jy@cn.fujitsu.com>,
David Safford <safford@us.ibm.com>,
Mimi Zohar <zohar@linux.vnet.ibm.com>,
linux-security-module@vger.kernel.org,
Eric Biggers <ebiggers@google.com>,
stable@vger.kernel.org
Subject: Re: [PATCH] KEYS: trusted: fix writing past end of buffer in trusted_read()
Date: Fri, 27 Oct 2017 09:55:39 +0200 (CEST) [thread overview]
Message-ID: <alpine.LFD.2.20.1710270954210.2635@localhost> (raw)
In-Reply-To: <20171026205744.105566-1-ebiggers3@gmail.com>
On Thu, 26 Oct 2017, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> When calling keyctl_read() on a key of type "trusted", if the
> user-supplied buffer was too small, the kernel ignored the buffer length
> and just wrote past the end of the buffer, potentially corrupting
> userspace memory. Fix it by instead returning the size required, as per
> the documentation for keyctl_read().
>
> We also don't even fill the buffer at all in this case, as this is
> slightly easier to implement than doing a short read, and either
> behavior appears to be permitted. It also makes it match the behavior
> of the "encrypted" key type.
>
> Fixes: d00a1c72f7f4 ("keys: add new trusted key-type")
> Reported-by: Ben Hutchings <ben@decadent.org.uk>
> Cc: <stable@vger.kernel.org> # v2.6.38+
> Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
--
James Morris
<james.l.morris@oracle.com>
WARNING: multiple messages have this Message-ID (diff)
From: james.l.morris@oracle.com (James Morris)
To: linux-security-module@vger.kernel.org
Subject: [PATCH] KEYS: trusted: fix writing past end of buffer in trusted_read()
Date: Fri, 27 Oct 2017 09:55:39 +0200 (CEST) [thread overview]
Message-ID: <alpine.LFD.2.20.1710270954210.2635@localhost> (raw)
In-Reply-To: <20171026205744.105566-1-ebiggers3@gmail.com>
On Thu, 26 Oct 2017, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> When calling keyctl_read() on a key of type "trusted", if the
> user-supplied buffer was too small, the kernel ignored the buffer length
> and just wrote past the end of the buffer, potentially corrupting
> userspace memory. Fix it by instead returning the size required, as per
> the documentation for keyctl_read().
>
> We also don't even fill the buffer at all in this case, as this is
> slightly easier to implement than doing a short read, and either
> behavior appears to be permitted. It also makes it match the behavior
> of the "encrypted" key type.
>
> Fixes: d00a1c72f7f4 ("keys: add new trusted key-type")
> Reported-by: Ben Hutchings <ben@decadent.org.uk>
> Cc: <stable@vger.kernel.org> # v2.6.38+
> Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
--
James Morris
<james.l.morris@oracle.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2017-10-27 7:55 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-26 20:57 [PATCH] KEYS: trusted: fix writing past end of buffer in trusted_read() Eric Biggers
2017-10-26 20:57 ` Eric Biggers
2017-10-26 20:57 ` Eric Biggers
2017-10-26 23:57 ` Mimi Zohar
2017-10-26 23:57 ` Mimi Zohar
2017-10-26 23:57 ` Mimi Zohar
2017-10-27 7:55 ` James Morris [this message]
2017-10-27 7:55 ` James Morris
2017-10-27 7:55 ` James Morris
2017-11-01 6:55 ` James Morris
2017-11-01 6:55 ` James Morris
2017-11-01 6:55 ` James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LFD.2.20.1710270954210.2635@localhost \
--to=james.l.morris@oracle.com \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.