]> git.baikalelectronics.ru Git - kernel.git/commit
crypto: ecdh - avoid buffer overflow in ecdh_set_secret()
authorArd Biesheuvel <ardb@kernel.org>
Sat, 2 Jan 2021 13:59:09 +0000 (14:59 +0100)
committerHerbert Xu <herbert@gondor.apana.org.au>
Sat, 2 Jan 2021 21:35:35 +0000 (08:35 +1100)
commitb0f1b041c185da2de7104bbdf4875659a41ceeb4
treef998a01d4f059ea5092a6d370e8d3a8832ec6a73
parent42ef5b1da51430eac0f26178b47edd11ed96aefb
crypto: ecdh - avoid buffer overflow in ecdh_set_secret()

Pavel reports that commit e9e283a19410 ("crypto: ecdh - avoid unaligned
accesses in ecdh_set_secret()") fixes one problem but introduces another:
the unconditional memcpy() introduced by that commit may overflow the
target buffer if the source data is invalid, which could be the result of
intentional tampering.

So check params.key_size explicitly against the size of the target buffer
before validating the key further.

Fixes: e9e283a19410 ("crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()")
Reported-by: Pavel Machek <pavel@denx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
crypto/ecdh.c