From 51a87e70c1fb375de584f8f951ce36f35a197abe Mon Sep 17 00:00:00 2001 From: Andreas Wellving Date: Wed, 17 Oct 2018 15:15:02 +0200 Subject: crypto: CVE-2017-17805 crypto: salsa20 - fix blkcipher_walk API usage References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.1.y&id=bbda4c57b91619642a94b193531312fe01bc2398 Change-Id: Ib25a70e786140a500ed7bb8360903e10f27d830f Signed-off-by: Andreas Wellving --- patches/cve/4.1.x.scc | 3 + ...ypto-salsa20-fix-blkcipher_walk-API-usage.patch | 97 ++++++++++++++++++++++ 2 files changed, 100 insertions(+) create mode 100644 patches/cve/CVE-2017-17805-crypto-salsa20-fix-blkcipher_walk-API-usage.patch diff --git a/patches/cve/4.1.x.scc b/patches/cve/4.1.x.scc index 475bc09..97f8d60 100644 --- a/patches/cve/4.1.x.scc +++ b/patches/cve/4.1.x.scc @@ -25,3 +25,6 @@ patch CVE-2017-1000111-packet-fix-tp_reserve-race-in-packet_set_ring.patch #fixed in 4.1.45 patch CVE-2018-10675-mm-mempolicy-fix-use-after-free-when-calling-get_mem.patch +#fixed in 4.1.49 +patch CVE-2017-17805-crypto-salsa20-fix-blkcipher_walk-API-usage.patch + diff --git a/patches/cve/CVE-2017-17805-crypto-salsa20-fix-blkcipher_walk-API-usage.patch b/patches/cve/CVE-2017-17805-crypto-salsa20-fix-blkcipher_walk-API-usage.patch new file mode 100644 index 0000000..bb08580 --- /dev/null +++ b/patches/cve/CVE-2017-17805-crypto-salsa20-fix-blkcipher_walk-API-usage.patch @@ -0,0 +1,97 @@ +From bbda4c57b91619642a94b193531312fe01bc2398 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Tue, 28 Nov 2017 20:56:59 -0800 +Subject: [PATCH] crypto: salsa20 - fix blkcipher_walk API usage + +[ Upstream commit ecaaab5649781c5a0effdaf298a925063020500e ] + +When asked to encrypt or decrypt 0 bytes, both the generic and x86 +implementations of Salsa20 crash in blkcipher_walk_done(), either when +doing 'kfree(walk->buffer)' or 'free_page((unsigned long)walk->page)', +because walk->buffer and walk->page have not been initialized. + +The bug is that Salsa20 is calling blkcipher_walk_done() even when +nothing is in 'walk.nbytes'. But blkcipher_walk_done() is only meant to +be called when a nonzero number of bytes have been provided. + +The broken code is part of an optimization that tries to make only one +call to salsa20_encrypt_bytes() to process inputs that are not evenly +divisible by 64 bytes. To fix the bug, just remove this "optimization" +and use the blkcipher_walk API the same way all the other users do. + +Reproducer: + + #include + #include + #include + + int main() + { + int algfd, reqfd; + struct sockaddr_alg addr = { + .salg_type = "skcipher", + .salg_name = "salsa20", + }; + char key[16] = { 0 }; + + algfd = socket(AF_ALG, SOCK_SEQPACKET, 0); + bind(algfd, (void *)&addr, sizeof(addr)); + reqfd = accept(algfd, 0, 0); + setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key)); + read(reqfd, key, sizeof(key)); + } + +CVE: CVE-2017-17805 +Upstream-Status: Backport + +Reported-by: syzbot +Fixes: eb6f13eb9f81 ("[CRYPTO] salsa20_generic: Fix multi-page processing") +Cc: # v2.6.25+ +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Andreas Wellving +--- + arch/x86/crypto/salsa20_glue.c | 7 ------- + crypto/salsa20_generic.c | 7 ------- + 2 files changed, 14 deletions(-) + +diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c +index 399a29d..cb91a64 100644 +--- a/arch/x86/crypto/salsa20_glue.c ++++ b/arch/x86/crypto/salsa20_glue.c +@@ -59,13 +59,6 @@ static int encrypt(struct blkcipher_desc *desc, + + salsa20_ivsetup(ctx, walk.iv); + +- if (likely(walk.nbytes == nbytes)) +- { +- salsa20_encrypt_bytes(ctx, walk.src.virt.addr, +- walk.dst.virt.addr, nbytes); +- return blkcipher_walk_done(desc, &walk, 0); +- } +- + while (walk.nbytes >= 64) { + salsa20_encrypt_bytes(ctx, walk.src.virt.addr, + walk.dst.virt.addr, +diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c +index f550b5d..d7da0ee 100644 +--- a/crypto/salsa20_generic.c ++++ b/crypto/salsa20_generic.c +@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc *desc, + + salsa20_ivsetup(ctx, walk.iv); + +- if (likely(walk.nbytes == nbytes)) +- { +- salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, +- walk.src.virt.addr, nbytes); +- return blkcipher_walk_done(desc, &walk, 0); +- } +- + while (walk.nbytes >= 64) { + salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, + walk.src.virt.addr, +-- +2.7.4 + -- cgit v1.2.3-54-g00ecf