Linux s390 cryptop EP11 buffer overflow: overflow check and ASN.1 parsing fix

Vulnerability Overview Vulnerability Name: s390/cryptop: Improve EP11 CPRB functionality and overflow checks Vulnerability Type: Buffer Overflow Vulnerability Description: 1. Missing minimum length validation: The EP11 header structure and subsequent payload (pid_tag, pid_len) lack minimum length checks, allowing the size check to be bypassed, leading to a buffer overflow. 2. Arithmetic overflow: In length calculations, CRLF alignment can cause overflow, allowing the size check to be bypassed, leading to a buffer overflow. 3. Payload parsing: The payload is ASN.1 encoded, and the function uses simple C struct overflow access to read certain fields. Scope of Impact Affected Component: Affected Versions: Linux kernel (specific versions not explicitly stated, but it involves the s390 architecture crypto driver) Affected Functionality: EP11 CPRB functionality, involving message header parsing and payload processing Fix Details Fix Content: 1. Add minimum length validation: Perform minimum length checks on the EP11 header structure and subsequent payload (pid_tag, pid_len). 2. Fix arithmetic overflow: In length calculations, ensure that CRLF alignment does not cause overflow. 3. Improve payload parsing: Use simple C struct overflow access for certain fields to ensure correct parsing. POC Code ```c / Minimum EP11 payload size / #define MIN_EP11_PAYLOAD_SIZE 5 / Simple ASN.1 integer decoding helper function / static inline int asn1_int_decode(const u8 buf, size_t len, u32 u) { switch (len) { case 1: u = (u32)buf; return 1; case 2: u = (u32)get_unaligned_be16(buf); return 2; case 4: u = (u32)get_unaligned_be32(buf); return 4; default: return -EINVAL; } } / Simple ASN.1 length parsing helper function / static inline int asn1_length_decode(const u8 buf, size_t len, u32 u) { int i; if (len = 0x80) { u = (u32)(buf & 0x7F); return 1; } if (!(buf == 1)) return -EINVAL; i = buf & 0x7F; i = asn1_int_decode(+buf + 1, i, u); return 1 + (i > 0 ? i : 1); } / Convert message to typed EP11 CPRB structure / static int xcrb_msg_to_typed_ep11cprb_msg(bool userspace, struct ap_message ap_msg, struct ep11_cprb xcrb, unsigned int code, unsigned int domain) { unsigned int lmt; struct struct typed_hdr static typed_hdr = { .type = 0x06, .code = 0x00, 0x01 }; static int xcrb_msg_to_typed_ep11cprb_msg(bool userspace, struct ap_message ap_msg, struct ep11_cprb xcrb, unsigned int code, unsigned int domain) { struct ep11_cprb corbx; unsigned char pid_tag; unsigned int code; unsigned int domain; DECLARE_FLEX_ARRAY(u8, userdata); struct ep11_cprb corbx; unsigned char pid_tag; unsigned int code; unsigned int domain; DECLARE_FLEX_ARRAY(u8, userdata); struct ep11_cprb corbx; unsigned char pid_tag; unsigned int code; unsigned int domain; DECLARE_FLEX_ARRAY(u8, userdata); struct ep11_cprb corbx; unsigned char pid_tag; unsigned int code; unsigned int domain; DECLARE_FLEX_ARRAY(u8, userdata); struct ep11_cprb corbx; unsigned char pid_tag; unsigned int code; unsigned int domain; DECLARE_FLEX_ARRAY(u8, userdata); struct ep11_cprb corbx; unsigned char pid_tag; unsigned int code; unsigned int domain; DECLARE_FLEX_ARRAY(u8, userdata); struct ep11_cprb corbx; unsigned char pid_tag; unsigned int code; unsigned int domain; DECLARE_FLEX_ARRAY(u8, userdata); struct ep11_cprb corbx; unsigned char pid_tag; unsigned int code; unsigned int *domain; DECLARE_FLEX

Goal Reached Thanks to every supporter — we hit 100%!

Linux s390 cryptop EP11 buffer overflow: overflow check and ASN.1 parsing fix

More from this source