d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

opencrypto: Disallow requests which pass VERIFY_DIGEST without a MAC

Browse Source 
Otherwise we can end up comparing the computed digest with an
uninitialized kernel buffer.

In cryptoaead_op() we already unconditionally fail the request if a
pointer to a digest buffer is not specified.

Based on a patch by Simran Kathpalia.

Reported by:	syzkaller
Reviewed by:	jhb
MFC after:	1 week
Pull Request:	https://github.com/freebsd/freebsd-src/pull/529
Differential Revision:	https://reviews.freebsd.org/D32124
This commit is contained in:
Mark Johnston 2021-09-24 15:04:45 -04:00
parent 1a25c51e38
commit 7c2f227a17
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/opencrypto/cryptodev.c
View File

@ -889,7 +889,7 @@ cryptodev_op(struct csession *cse, const struct crypt_op *cop)
dst += cse->ivsize;
}
if (cop->mac != NULL && crp->crp_op & CRYPTO_OP_VERIFY_DIGEST) {
if (crp->crp_op & CRYPTO_OP_VERIFY_DIGEST) {
error = copyin(cop->mac, cod->buf + crp->crp_digest_start,
cse->hashsize);
if (error) {