kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/certs
History
Lukas Wunner d3caf4298c X.509: Fix validation of ASN.1 certificate header 
[ Upstream commit 3b626ba431 ]

x509_load_certificate_list() seeks to enforce that a certificate starts
with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256
and less than 65535 bytes).

But it only enforces that *either* of those two byte values are present,
instead of checking for the *conjunction* of the two values.  Fix it.

Fixes: 631cc66eb9 ("MODSIGN: Provide module signing public keys to the kernel")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260508033917.B5873C2BCB0@smtp.kernel.org/
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.7+
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-07-24 15:51:59 +02:00
..
.gitignore .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
blacklist.c certs: Add ability to preload revocation certs 2021-03-11 16:33:49 +00:00
blacklist.h certs: Add EFI_CERT_X509_GUID support for dbx entries 2021-03-11 16:31:28 +00:00
blacklist_hashes.c certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
blacklist_nohashes.c certs/blacklist_nohashes.c: fix const confusion in certs blacklist 2018-02-21 15:35:43 -08:00
common.c X.509: Fix validation of ASN.1 certificate header 2026-07-24 15:51:59 +02:00
common.h certs: Move load_system_certificate_list to a common function 2021-03-11 16:32:38 +00:00
Kconfig certs: Add support for using elliptic curve keys for signing modules 2021-08-23 19:55:42 +03:00
Makefile certs: Add support for using elliptic curve keys for signing modules 2021-08-23 19:55:42 +03:00
revocation_certificates.S certs: Add ability to preload revocation certs 2021-03-11 16:33:49 +00:00
system_certificates.S ima: ensure IMA_APPRAISE_MODSIG has necessary dependencies 2021-04-26 21:54:23 -04:00
system_keyring.c integrity-v5.13 2021-05-01 15:32:18 -07:00