[linux] 10/18: mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (CVE-2016-8650)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Thu Dec 29 03:44:12 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch jessie
in repository linux.
commit 95da0e724982cf5732bb06eacf019b5d77323120
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Wed Dec 28 23:26:12 2016 +0000
mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (CVE-2016-8650)
---
debian/changelog | 1 +
...ix-null-ptr-dereference-in-mpi_powm-ver-3.patch | 96 ++++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 98 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 2807d6d..d6cfb7e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -500,6 +500,7 @@ linux (3.16.39-1) UNRELEASED; urgency=medium
* net: Add __sock_queue_rcv_skb()
* rose,dccp: limit sk_filter trim to payload
* tcp: take care of truncations done by sk_filter() (CVE-2016-8645)
+ * mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (CVE-2016-8650)
[ Julien Cristau ]
* hwrng: Add chaoskey driver, backported from 4.8 (Closes: #839616)
diff --git a/debian/patches/bugfix/all/mpi-fix-null-ptr-dereference-in-mpi_powm-ver-3.patch b/debian/patches/bugfix/all/mpi-fix-null-ptr-dereference-in-mpi_powm-ver-3.patch
new file mode 100644
index 0000000..bb07255
--- /dev/null
+++ b/debian/patches/bugfix/all/mpi-fix-null-ptr-dereference-in-mpi_powm-ver-3.patch
@@ -0,0 +1,96 @@
+From: Andrey Ryabinin <aryabinin at virtuozzo.com>
+Date: Thu, 24 Nov 2016 13:23:10 +0000
+Subject: mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]
+Origin: https://git.kernel.org/linus/f5527fffff3f002b0a6b376163613b82f69de073
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2016-8650
+
+This fixes CVE-2016-8650.
+
+If mpi_powm() is given a zero exponent, it wants to immediately return
+either 1 or 0, depending on the modulus. However, if the result was
+initalised with zero limb space, no limbs space is allocated and a
+NULL-pointer exception ensues.
+
+Fix this by allocating a minimal amount of limb space for the result when
+the 0-exponent case when the result is 1 and not touching the limb space
+when the result is 0.
+
+This affects the use of RSA keys and X.509 certificates that carry them.
+
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
+PGD 0
+Oops: 0002 [#1] SMP
+Modules linked in:
+CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278
+Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
+task: ffff8804011944c0 task.stack: ffff880401294000
+RIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
+RSP: 0018:ffff880401297ad8 EFLAGS: 00010212
+RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0
+RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0
+RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000
+R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50
+FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0
+Stack:
+ ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4
+ 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30
+ ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8
+Call Trace:
+ [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66
+ [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d
+ [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd
+ [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146
+ [<ffffffff8132a95c>] rsa_verify+0x9d/0xee
+ [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb
+ [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1
+ [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228
+ [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4
+ [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1
+ [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1
+ [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61
+ [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399
+ [<ffffffff812fe227>] SyS_add_key+0x154/0x19e
+ [<ffffffff81001c2b>] do_syscall_64+0x80/0x191
+ [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25
+Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f
+RIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
+ RSP <ffff880401297ad8>
+CR2: 0000000000000000
+---[ end trace d82015255d4a5d8d ]---
+
+Basically, this is a backport of a libgcrypt patch:
+
+ http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526
+
+Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)")
+Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
+Signed-off-by: David Howells <dhowells at redhat.com>
+cc: Dmitry Kasatkin <dmitry.kasatkin at gmail.com>
+cc: linux-ima-devel at lists.sourceforge.net
+cc: stable at vger.kernel.org
+Signed-off-by: James Morris <james.l.morris at oracle.com>
+---
+ lib/mpi/mpi-pow.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/lib/mpi/mpi-pow.c
++++ b/lib/mpi/mpi-pow.c
+@@ -64,8 +64,13 @@ int mpi_powm(MPI res, MPI base, MPI exp,
+ if (!esize) {
+ /* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0
+ * depending on if MOD equals 1. */
+- rp[0] = 1;
+ res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1;
++ if (res->nlimbs) {
++ if (mpi_resize(res, 1) < 0)
++ goto enomem;
++ rp = res->d;
++ rp[0] = 1;
++ }
+ res->sign = 0;
+ goto leave;
+ }
diff --git a/debian/patches/series b/debian/patches/series
index 5f81aae..5c1a4b1 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -668,6 +668,7 @@ features/all/net-add-__sock_queue_rcv_skb.patch
bugfix/all/rose-limit-sk_filter-trim-to-payload.patch
bugfix/all/dccp-limit-sk_filter-trim-to-payload.patch
bugfix/all/tcp-take-care-of-truncations-done-by-sk_filter.patch
+bugfix/all/mpi-fix-null-ptr-dereference-in-mpi_powm-ver-3.patch
# Fix ABI changes
debian/of-fix-abi-changes.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list