Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Ard Biesheuvel 0aa171e9b2 crypto: ecdh - avoid buffer overflow in ecdh_set_secret() ...

Pavel reports that commit 17858b140b ("crypto: ecdh - avoid unaligned
accesses in ecdh_set_secret()") fixes one problem but introduces another:
the unconditional memcpy() introduced by that commit may overflow the
target buffer if the source data is invalid, which could be the result of
intentional tampering.

So check params.key_size explicitly against the size of the target buffer
before validating the key further.

Fixes: 17858b140b ("crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()")
Reported-by: Pavel Machek <pavel@denx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

2021-01-03 08:35:35 +11:00

171 lines

4 KiB

Raw Permalink Blame History