• Eric Biggers's avatar
    KEYS: fix out-of-bounds read during ASN.1 parsing · 2eb9eabf
    Eric Biggers authored
    syzkaller with KASAN reported an out-of-bounds read in
    asn1_ber_decoder().  It can be reproduced by the following command,
    assuming CONFIG_X509_CERTIFICATE_PARSER=y and CONFIG_KASAN=y:
    
        keyctl add asymmetric desc $'\x30\x30' @s
    
    The bug is that the length of an ASN.1 data value isn't validated in the
    case where it is encoded using the short form, causing the decoder to
    read past the end of the input buffer.  Fix it by validating the length.
    
    The bug report was:
    
        BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x10cb/0x1730 lib/asn1_decoder.c:233
        Read of size 1 at addr ffff88003cccfa02 by task syz-executor0/6818
    
        CPU: 1 PID: 6818 Comm: syz-executor0 Not tainted 4.14.0-rc7-00008-g5f479447 #2
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
        Call Trace:
         __dump_stack lib/dump_stack.c:16 [inline]
         dump_stack+0xb3/0x10b lib/dump_stack.c:52
         print_address_description+0x79/0x2a0 mm/kasan/report.c:252
         kasan_report_error mm/kasan/report.c:351 [inline]
         kasan_report+0x236/0x340 mm/kasan/report.c:409
         __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:427
         asn1_ber_decoder+0x10cb/0x1730 lib/asn1_decoder.c:233
         x509_cert_parse+0x1db/0x650 crypto/asymmetric_keys/x509_cert_parser.c:89
         x509_key_preparse+0x64/0x7a0 crypto/asymmetric_keys/x509_public_key.c:174
         asymmetric_key_preparse+0xcb/0x1a0 crypto/asymmetric_keys/asymmetric_type.c:388
         key_create_or_update+0x347/0xb20 security/keys/key.c:855
         SYSC_add_key security/keys/keyctl.c:122 [inline]
         SyS_add_key+0x1cd/0x340 security/keys/keyctl.c:62
         entry_SYSCALL_64_fastpath+0x1f/0xbe
        RIP: 0033:0x447c89
        RSP: 002b:00007fca7a5d3bd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
        RAX: ffffffffffffffda RBX: 00007fca7a5d46cc RCX: 0000000000447c89
        RDX: 0000000020006f4a RSI: 0000000020006000 RDI: 0000000020001ff5
        RBP: 0000000000000046 R08: fffffffffffffffd R09: 0000000000000000
        R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
        R13: 0000000000000000 R14: 00007fca7a5d49c0 R15: 00007fca7a5d4700
    
    Fixes: 42d5ec27 ("X.509: Add an ASN.1 decoder")
    Cc: <stable@vger.kernel.org> # v3.7+
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
    2eb9eabf
asn1_decoder.c 13.3 KB