From 7dc6d3e9126398ae2ec4a86083d4b6e19da27afb Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Wed, 8 Mar 2023 14:08:02 +0000 Subject: [PATCH] crypto: rsa-pkcs1pad - restore signature length check mainline inclusion from mainline-v5.18-rc1 commit d3481accd974541e6a5d6a1fb588924a3519c36e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6ETWH CVE: NA -------------------------------- RSA PKCS#1 v1.5 signatures are required to be the same length as the RSA key size. RFC8017 specifically requires the verifier to check this (https://datatracker.ietf.org/doc/html/rfc8017#section-8.2.2). Commit a49de377e051 ("crypto: Add hash param to pkcs1pad") changed the kernel to allow longer signatures, but didn't explain this part of the change; it seems to be unrelated to the rest of the commit. Revert this change, since it doesn't appear to be correct. We can be pretty sure that no one is relying on overly-long signatures (which would have to be front-padded with zeroes) being supported, given that they would have been broken since commit c7381b012872 ("crypto: akcipher - new verify API for public key algorithms"). Fixes: a49de377e051 ("crypto: Add hash param to pkcs1pad") Cc: # v4.6+ Cc: Tadeusz Struk Suggested-by: Vitaly Chikunov Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Conflicts: crypto/rsa-pkcs1pad.c Signed-off-by: GUO Zihua Reviewed-by: yiyang Reviewed-by: Wang Weiyang Signed-off-by: Yongqiang Liu --- crypto/rsa-pkcs1pad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c index ab2e74e23a7d..48bd07e22a1d 100644 --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -528,7 +528,7 @@ static int pkcs1pad_verify(struct akcipher_request *req) struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req); int err; - if (!ctx->key_size || req->src_len < ctx->key_size) + if (!ctx->key_size || req->src_len != ctx->key_size) return -EINVAL; req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL); -- GitLab