diff mbox

[2/2] MPI: Fix mpi_powm() when exponent is 0 and the result has no limbs

Message ID 147997747766.9316.11606802798600210253.stgit@warthog.procyon.org.uk (mailing list archive)
State New, archived
Headers show

Commit Message

David Howells Nov. 24, 2016, 8:51 a.m. UTC 
This fixes CVE-2016-8650.

If mpi_powm() is given a zero exponent, it wants to immediately return
either 1 or 0, depending on the modulus.  However, if the result was
initalised with zero limb space, no limbs space is allocated and a
NULL-pointer exception ensues.

Fix this by allocating a minimal amount of limb space for the result when
handling the 0-exponent case.

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
PGD 0
Oops: 0002 [#1] SMP
Modules linked in:
CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
task: ffff8804011944c0 task.stack: ffff880401294000
RIP: 0010:[<ffffffff8138ce5d>]  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
RSP: 0018:ffff880401297ad8  EFLAGS: 00010212
RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0
RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0
RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000
R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50
FS:  00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0
Stack:
 ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4
 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30
 ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8
Call Trace:
 [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66
 [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d
 [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd
 [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146
 [<ffffffff8132a95c>] rsa_verify+0x9d/0xee
 [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb
 [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1
 [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228
 [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4
 [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1
 [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1
 [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61
 [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399
 [<ffffffff812fe227>] SyS_add_key+0x154/0x19e
 [<ffffffff81001c2b>] do_syscall_64+0x80/0x191
 [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25
Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f
RIP  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
 RSP <ffff880401297ad8>
CR2: 0000000000000000
---[ end trace d82015255d4a5d8d ]---

Fixes: cdec9cb5167a ('crypto: GnuPG based MPI lib - source files (part 1)')
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
cc: linux-ima-devel@lists.sourceforge.net
cc: stable@vger.kernel.org
---

 lib/mpi/mpi-pow.c |    5 +++++
 1 file changed, 5 insertions(+)


--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

David Howells Nov. 24, 2016, 11:17 a.m. UTC | #1 
David Howells <dhowells@redhat.com> wrote:

> +		if (!rp) {
> +			if (mpi_resize(res, 1) < 0)

This is better done with RESIZE_IF_NEEDED().

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Andrey Ryabinin Nov. 24, 2016, 11:20 a.m. UTC | #2 
2016-11-24 11:51 GMT+03:00 David Howells <dhowells@redhat.com>:
> This fixes CVE-2016-8650.
>
> If mpi_powm() is given a zero exponent, it wants to immediately return
> either 1 or 0, depending on the modulus.  However, if the result was
> initalised with zero limb space, no limbs space is allocated and a
> NULL-pointer exception ensues.
>
> Fix this by allocating a minimal amount of limb space for the result when
> handling the 0-exponent case.
>
> BUG: unable to handle kernel NULL pointer dereference at           (null)
> IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
> PGD 0
> Oops: 0002 [#1] SMP
> Modules linked in:
> CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278
> Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
> task: ffff8804011944c0 task.stack: ffff880401294000
> RIP: 0010:[<ffffffff8138ce5d>]  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
> RSP: 0018:ffff880401297ad8  EFLAGS: 00010212
> RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0
> RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0
> RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000
> R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50
> FS:  00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0
> Stack:
>  ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4
>  0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30
>  ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8
> Call Trace:
>  [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66
>  [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d
>  [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd
>  [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146
>  [<ffffffff8132a95c>] rsa_verify+0x9d/0xee
>  [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb
>  [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1
>  [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228
>  [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4
>  [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1
>  [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1
>  [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61
>  [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399
>  [<ffffffff812fe227>] SyS_add_key+0x154/0x19e
>  [<ffffffff81001c2b>] do_syscall_64+0x80/0x191
>  [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25
> Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f
> RIP  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6
>  RSP <ffff880401297ad8>
> CR2: 0000000000000000
> ---[ end trace d82015255d4a5d8d ]---
>
> Fixes: cdec9cb5167a ('crypto: GnuPG based MPI lib - source files (part 1)')
> Signed-off-by: David Howells <dhowells@redhat.com>
> cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
> cc: linux-ima-devel@lists.sourceforge.net
> cc: stable@vger.kernel.org
> ---
>
>  lib/mpi/mpi-pow.c |    5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c
> index 5464c8744ea9..d72d347e62d1 100644
> --- a/lib/mpi/mpi-pow.c
> +++ b/lib/mpi/mpi-pow.c
> @@ -64,6 +64,11 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
>         if (!esize) {
>                 /* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0
>                  * depending on if MOD equals 1.  */
> +               if (!rp) {
> +                       if (mpi_resize(res, 1) < 0)
> +                               return -ENOMEM;
> +                       rp = res->d;
> +               }

I'm also made a fix for this yesterday -
http://lkml.kernel.org/r/1479918484-31952-1-git-send-email-aryabinin@virtuozzo.com
The only small difference is that in my the limb space is not
allocated when it's not needed, i.e. when res->nlimbs == 0.

>                 rp[0] = 1;
>                 res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1;
>                 res->sign = 0;
>
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Andrey Ryabinin Nov. 24, 2016, 11:22 a.m. UTC | #3 
2016-11-24 14:17 GMT+03:00 David Howells <dhowells@redhat.com>:
> David Howells <dhowells@redhat.com> wrote:
>
>> +             if (!rp) {
>> +                     if (mpi_resize(res, 1) < 0)
>
> This is better done with RESIZE_IF_NEEDED().
>

mpi_resize() is equal to RESIZE_IF_NEEDED(), it also checks for allocated space:

int mpi_resize(MPI a, unsigned nlimbs)
{
....
   if (nlimbs <= a->alloced)
    return 0; /* no need to do it */



> David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Howells Nov. 24, 2016, 11:33 a.m. UTC | #4 
Andrey Ryabinin <ryabinin.a.a@gmail.com> wrote:

> > David Howells <dhowells@redhat.com> wrote:
> >
> >> +             if (!rp) {
> >> +                     if (mpi_resize(res, 1) < 0)
> >
> > This is better done with RESIZE_IF_NEEDED().
> >
> 
> mpi_resize() is equal to RESIZE_IF_NEEDED(), it also checks for allocated space:
> 
> int mpi_resize(MPI a, unsigned nlimbs)
> {
> ....
>    if (nlimbs <= a->alloced)
>     return 0; /* no need to do it */

Hmmm...  In that case, should your patch use mpi_resize() rather than
RESIZE_IF_NEEDED()?  It's a trivial case that we should perhaps weed out much
earlier (ie. reject the key if exp<2 or mod<2), but it would make the object
file slightly smaller not to do the test twice.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Howells Nov. 24, 2016, 11:35 a.m. UTC | #5 
Andrey Ryabinin <ryabinin.a.a@gmail.com> wrote:

> I'm also made a fix for this yesterday -
> http://lkml.kernel.org/r/1479918484-31952-1-git-send-email-aryabinin@virtuozzo.com

I should add a record to the MAINTAINERS file that directs patches to MPI to
keyrings@vger.kernel.org so that I see things like this.

> The only small difference is that in my the limb space is not
> allocated when it's not needed, i.e. when res->nlimbs == 0.

I guess if nlimbs is 0 then the value is 0, right?

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Andrey Ryabinin Nov. 24, 2016, 12:20 p.m. UTC | #6 
2016-11-24 14:33 GMT+03:00 David Howells <dhowells@redhat.com>:
> Andrey Ryabinin <ryabinin.a.a@gmail.com> wrote:
>
>> > David Howells <dhowells@redhat.com> wrote:
>> >
>> >> +             if (!rp) {
>> >> +                     if (mpi_resize(res, 1) < 0)
>> >
>> > This is better done with RESIZE_IF_NEEDED().
>> >
>>
>> mpi_resize() is equal to RESIZE_IF_NEEDED(), it also checks for allocated space:
>>
>> int mpi_resize(MPI a, unsigned nlimbs)
>> {
>> ....
>>    if (nlimbs <= a->alloced)
>>     return 0; /* no need to do it */
>
> Hmmm...  In that case, should your patch use mpi_resize() rather than
> RESIZE_IF_NEEDED()? It's a trivial case that we should perhaps weed out much
> earlier (ie. reject the key if exp<2 or mod<2), but it would make the object
> file slightly smaller not to do the test twice.
>

Right, it could be mpi_resize(). I realized that these two functions
do the exactly the same thing only after I send the patch.
We could even remove RESIZE_IF_NEEDED() to not confuse people, because
currently it has no users.

> David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Andrey Ryabinin Nov. 24, 2016, 12:20 p.m. UTC | #7 
2016-11-24 14:35 GMT+03:00 David Howells <dhowells@redhat.com>:
> Andrey Ryabinin <ryabinin.a.a@gmail.com> wrote:
>
>> I'm also made a fix for this yesterday -
>> http://lkml.kernel.org/r/1479918484-31952-1-git-send-email-aryabinin@virtuozzo.com
>
> I should add a record to the MAINTAINERS file that directs patches to MPI to
> keyrings@vger.kernel.org so that I see things like this.
>

Would be nice. It was unclear who maintains it. Since all recent
changes to mpi were merged through crypto tree,
I send this to crypto maintainers.

>> The only small difference is that in my the limb space is not
>> allocated when it's not needed, i.e. when res->nlimbs == 0.
>
> I guess if nlimbs is 0 then the value is 0, right?
>

Right, as far as I understand.


> David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c
index 5464c8744ea9..d72d347e62d1 100644
--- a/lib/mpi/mpi-pow.c
+++ b/lib/mpi/mpi-pow.c
@@ -64,6 +64,11 @@  int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
 	if (!esize) {
 		/* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0
 		 * depending on if MOD equals 1.  */
+		if (!rp) {
+			if (mpi_resize(res, 1) < 0)
+				return -ENOMEM;
+			rp = res->d;
+		}
 		rp[0] = 1;
 		res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1;
 		res->sign = 0;