From patchwork Fri Jun 2 17:25:01 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Biggers X-Patchwork-Id: 9763089 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 76D2E60360 for ; Fri, 2 Jun 2017 17:26:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 60C3C28591 for ; Fri, 2 Jun 2017 17:26:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5552B2859E; Fri, 2 Jun 2017 17:26:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0124A28591 for ; Fri, 2 Jun 2017 17:26:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751169AbdFBR0D (ORCPT ); Fri, 2 Jun 2017 13:26:03 -0400 Received: from mail-pf0-f193.google.com ([209.85.192.193]:36672 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751141AbdFBR0C (ORCPT ); Fri, 2 Jun 2017 13:26:02 -0400 Received: by mail-pf0-f193.google.com with SMTP id n23so12912441pfb.3; Fri, 02 Jun 2017 10:26:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=wy2QL+sdeJfkI3DGwkGXId3t9zblTp6wHTUzZMzWSkU=; b=JJWXuQVrYkco8SSNMuh5uZy0uYBkdDzAQhQQjplXBqmUuD13NGETizZ1sjYHmij0Db 6/JfSfim58KJoF/pnvNpOqzodpzVsae34Y6rJ6+INCJhlSRRbM6tWrXOjc4jD4OSbPR7 15cIiH2h05Kv6NqKM2IqwtROJ4+u4l3FEyUJxfwWNZhrv3J6c/jh466rAtZsnJLEntyU p5QQTpfCD8FS5qqiLi8gxHT9xdEo6eLcIoFGiO6EVuFDj/aEh6y+ez/80/m+59JpA0mq N9QLBDNJHJd5J8lT4VheXMAATWmhIOsNgAPlP3NBf7ZNtKpnPZcJdZYqoEMS+e3oGrVt s+lw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=wy2QL+sdeJfkI3DGwkGXId3t9zblTp6wHTUzZMzWSkU=; b=VjUa3Zae92LWTJ2FqMZKIWqMYHZvnoH61hMnQ91X80aTLrG1/07il7dm9SDhpaQ94U SHjXf4gjZXQlHpkJ5dBfeZHC+DCVn9M/o8SaKO93NvnQsUhg8QHdBZAxFt0+Dn8IMxPV AKB0szbXYHHra45C+VHFCTdBXLpRribOlt8oMJWunlK3kdsnvRgry3nAzE1e0beoVlYM wj24qNLzsMFFqaGCfnqWyxT9Wz+N3noYS7Zv2xCJHEaIBfGgmEZWVETPlfZXbV+w0a1G GB/R0uiz+sY3UzyVH3am+GBCoyJzOL6X/ByET89qM1U0lutAhiVaT/fl7ASe5kFUbiCX Zf/Q== X-Gm-Message-State: AODbwcAYtw12p4sZlvNFHkt+KmguVMHGOPZ023xl2ITNQuGFm+LxDqXP rVMify+mh6I3k3u7dxA= X-Received: by 10.84.169.3 with SMTP id g3mr991013plb.37.1496424361150; Fri, 02 Jun 2017 10:26:01 -0700 (PDT) Received: from localhost.localdomain (c-73-239-167-150.hsd1.wa.comcast.net. [73.239.167.150]) by smtp.gmail.com with ESMTPSA id r73sm39755099pfk.114.2017.06.02.10.26.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 02 Jun 2017 10:26:00 -0700 (PDT) From: Eric Biggers To: keyrings@vger.kernel.org Cc: dhowells@redhat.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Biggers Subject: [PATCH v2] KEYS: sanitize add_key() and keyctl() key payloads Date: Fri, 2 Jun 2017 10:25:01 -0700 Message-Id: <20170602172501.4853-1-ebiggers3@gmail.com> X-Mailer: git-send-email 2.13.0 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Eric Biggers Before returning from add_key() or one of the keyctl() commands that takes in a key payload, zero the temporary buffer that was allocated to hold the key payload copied from userspace. This may contain sensitive key material that should not be kept around in the slab caches. Signed-off-by: Eric Biggers --- security/keys/keyctl.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index 94c2790f8283..ab0b337c84b4 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -132,7 +132,10 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, key_ref_put(keyring_ref); error3: - kvfree(payload); + if (payload) { + memzero_explicit(payload, plen); + kvfree(payload); + } error2: kfree(description); error: @@ -347,7 +350,7 @@ long keyctl_update_key(key_serial_t id, key_ref_put(key_ref); error2: - kfree(payload); + kzfree(payload); error: return ret; } @@ -1093,7 +1096,10 @@ long keyctl_instantiate_key_common(key_serial_t id, keyctl_change_reqkey_auth(NULL); error2: - kvfree(payload); + if (payload) { + memzero_explicit(payload, plen); + kvfree(payload); + } error: return ret; }