kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/security/integrity/evm
History
Ryan Ware 50e2fe0e98 EVM: Use crypto_memneq() for digest comparisons 
commit 613317bd21 upstream.

This patch fixes vulnerability CVE-2016-2085.  The problem exists
because the vm_verify_hmac() function includes a use of memcmp().
Unfortunately, this allows timing side channel attacks; specifically
a MAC forgery complexity drop from 2^128 to 2^12.  This patch changes
the memcmp() to the cryptographically safe crypto_memneq().

Reported-by: Xiaofei Rex Guo <xiaofei.rex.guo@intel.com>
Signed-off-by: Ryan Ware <ware@linux.intel.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Cc: Moritz Muehlenhoff <jmm@inutil.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2016-02-16 10:55:28 +00:00
..
evm.h evm: replace HMAC version with attribute mask 2014-06-12 17:58:06 -04:00
evm_crypto.c evm: replace HMAC version with attribute mask 2014-06-12 17:58:06 -04:00
evm_main.c EVM: Use crypto_memneq() for digest comparisons 2016-02-16 10:55:28 +00:00
evm_posix_acl.c ima: fix script messages 2013-10-25 13:17:19 -04:00
evm_secfs.c security: integrity: Use a more current logging style 2014-03-07 12:15:21 -05:00
Kconfig evm: provide option to protect additional SMACK xattrs 2014-06-12 17:58:06 -04:00
Makefile evm: posix acls modify i_mode 2011-09-14 15:24:51 -04:00