Eric Biggers 9fa68f6200 crypto: hash - prevent using keyed hashes without setting key ... Currently, almost none of the keyed hash algorithms check whether a key has been set before proceeding. Some algorithms are okay with this and will effectively just use a key of all 0's or some other bogus default. However, others will severely break, as demonstrated using "hmac(sha3-512-generic)", the unkeyed use of which causes a kernel crash via a (potentially exploitable) stack buffer overflow. A while ago, this problem was solved for AF_ALG by pairing each hash transform with a 'has_key' bool. However, there are still other places in the kernel where userspace can specify an arbitrary hash algorithm by name, and the kernel uses it as unkeyed hash without checking whether it is really unkeyed. Examples of this include: - KEYCTL_DH_COMPUTE, via the KDF extension - dm-verity - dm-crypt, via the ESSIV support - dm-integrity, via the "internal hash" mode with no key given - drbd (Distributed Replicated Block Device) This bug is especially bad for KEYCTL_DH_COMPUTE as that requires no privileges to call. Fix the bug for all users by adding a flag CRYPTO_TFM_NEED_KEY to the ->crt_flags of each hash transform that indicates whether the transform still needs to be keyed or not. Then, make the hash init, import, and digest functions return -ENOKEY if the key is still needed. The new flag also replaces the 'has_key' bool which algif_hash was previously using, thereby simplifying the algif_hash implementation. Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>		2018-01-12 23:03:37 +11:00
..
acpi	Merge branch 'acpi-ec' into acpi	2017-11-30 13:37:29 +01:00
asm-generic	mm: switch to 'define pmd_write' instead of __HAVE_ARCH_PMD_WRITE	2017-11-29 18:40:42 -08:00
clocksource
crypto	crypto: hash - prevent using keyed hashes without setting key	2018-01-12 23:03:37 +11:00
drm	drm: safely free connectors from connector_iter	2017-12-06 10:22:55 +01:00
dt-bindings
keys
kvm	KVM: arm/arm64: Don't enable/disable physical timer access on VHE	2017-11-29 16:46:09 +01:00
linux	crypto: hash - prevent using keyed hashes without setting key	2018-01-12 23:03:37 +11:00
math-emu
media
memory
misc
net	tcp: invalidate rate samples during SACK reneging	2017-12-08 10:07:02 -05:00
pcmcia
ras
rdma
scsi
soc
sound
target
trace	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2017-12-03 13:08:30 -05:00
uapi	KVM fixes for v4.15-rc3	2017-12-10 08:24:16 -08:00
video
xen