Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/809994/?format=api
{ "id": 809994, "url": "http://patchwork.ozlabs.org/api/patches/809994/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20170905083129.23453-2-kleber.souza@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20170905083129.23453-2-kleber.souza@canonical.com>", "list_archive_url": null, "date": "2017-09-05T08:31:29", "name": "[Trusty,SRU,1/1] mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "b3d071d21eb48550b84064c93e4a7f8e84e0ac00", "submitter": { "id": 71419, "url": "http://patchwork.ozlabs.org/api/people/71419/?format=api", "name": "Kleber Sacilotto de Souza", "email": "kleber.souza@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20170905083129.23453-2-kleber.souza@canonical.com/mbox/", "series": [ { "id": 1509, "url": "http://patchwork.ozlabs.org/api/series/1509/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=1509", "date": "2017-09-05T08:31:28", "name": "Fix for CVE-2016-8650", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/1509/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/809994/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/809994/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@bilbo.ozlabs.org", "Authentication-Results": "ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com\n\t(client-ip=91.189.94.19; helo=huckleberry.canonical.com;\n\tenvelope-from=kernel-team-bounces@lists.ubuntu.com;\n\treceiver=<UNKNOWN>)", "Received": [ "from huckleberry.canonical.com (huckleberry.canonical.com\n\t[91.189.94.19])\n\tby ozlabs.org (Postfix) with ESMTP id 3xmg1C1dpNz9sP3;\n\tTue, 5 Sep 2017 18:31:43 +1000 (AEST)", "from localhost ([127.0.0.1] helo=huckleberry.canonical.com)\n\tby huckleberry.canonical.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1dp9Gh-00048p-P4; Tue, 05 Sep 2017 08:31:35 +0000", "from youngberry.canonical.com ([91.189.89.112])\n\tby huckleberry.canonical.com with esmtps\n\t(TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128)\n\t(Exim 4.86_2) (envelope-from <kleber.souza@canonical.com>)\n\tid 1dp9Gg-00048V-7c\n\tfor kernel-team@lists.ubuntu.com; Tue, 05 Sep 2017 08:31:34 +0000", "from mail-wm0-f71.google.com ([74.125.82.71])\n\tby youngberry.canonical.com with esmtps\n\t(TLS1.0:RSA_AES_128_CBC_SHA1:16)\n\t(Exim 4.76) (envelope-from <kleber.souza@canonical.com>)\n\tid 1dp9Gg-0000mB-09\n\tfor kernel-team@lists.ubuntu.com; Tue, 05 Sep 2017 08:31:34 +0000", "by mail-wm0-f71.google.com with SMTP id p17so3199819wmd.3\n\tfor <kernel-team@lists.ubuntu.com>;\n\tTue, 05 Sep 2017 01:31:33 -0700 (PDT)", "from localhost (ip5f5bd015.dynamic.kabel-deutschland.de.\n\t[95.91.208.21])\n\tby smtp.gmail.com with ESMTPSA id o6sm14283edb.10.2017.09.05.01.31.32\n\tfor <kernel-team@lists.ubuntu.com>\n\t(version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256);\n\tTue, 05 Sep 2017 01:31:32 -0700 (PDT)" ], "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:subject:date:message-id:in-reply-to\n\t:references;\n\tbh=NHTvxKXoWB3GE79rF6YWC5ZE343Oq6k+7sCjCFBNAOU=;\n\tb=nJ7Obh2X8+lKzALciRz7VejN/HOe9KLNivq/Tw22AoO3l2ZEgX2H4gHerPKl5dJkXt\n\tRu/qVmcUB7fvEdl8ru32uR+ZG5Rp6+/EKup6NuRPa+ll/JKXUUFpNcD97c2oFYUBnwtM\n\tq6uv/Vl6goHYCfojV6aKaXBKL5eh+OAmyLzIsmWCmkQQmHAgHPRCOEF85aNlQnaYEirR\n\trvJA5CEpEywBJMZd55uC59iAo1Xeu0jVveShynsp7vfa4q7vX99AeDA6vibBaNyyVoIR\n\tzShYC7RKqN7ER/mYz7i/zanCGUeXmkGOAd+wzFTUcrUuf6p0cBwxHv0j5Iix4u6ZR6JO\n\tiJSw==", "X-Gm-Message-State": "AHPjjUgeTpmLspQHgzCIn0CUXNmmYRVQ38/JQQPqkFGaYgst5L5RCwQF\n\tACZxQEZDNzkz3ygab3GvQmkgqdqNa51URd6aU8TbIduywovXP+UFNUA4Hs4PaFmAv5bc46VZ+O4\n\tZ6k9uE5jWpIyMGDpPqNsGbhZZgVFLx1EZ", "X-Received": [ "by 10.80.225.131 with SMTP id k3mr2674538edl.218.1504600293375; \n\tTue, 05 Sep 2017 01:31:33 -0700 (PDT)", "by 10.80.225.131 with SMTP id k3mr2674530edl.218.1504600293079; \n\tTue, 05 Sep 2017 01:31:33 -0700 (PDT)" ], "X-Google-Smtp-Source": "ADKCNb7aUwx0JSlg7MYdn80vIPRBuEP4U3YUtsLsgAAErGxaOQ+lDfK3VCmJ81/RAYtlknT3CDM0Hw==", "From": "Kleber Sacilotto de Souza <kleber.souza@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[Trusty SRU][PATCH 1/1] mpi: Fix NULL ptr dereference in mpi_powm()\n\t[ver #3]", "Date": "Tue, 5 Sep 2017 10:31:29 +0200", "Message-Id": "<20170905083129.23453-2-kleber.souza@canonical.com>", "X-Mailer": "git-send-email 2.14.1", "In-Reply-To": "<20170905083129.23453-1-kleber.souza@canonical.com>", "References": "<20170905083129.23453-1-kleber.souza@canonical.com>", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n\t<mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n\t<mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Andrey Ryabinin <aryabinin@virtuozzo.com>\n\nThis fixes CVE-2016-8650.\n\nIf mpi_powm() is given a zero exponent, it wants to immediately return\neither 1 or 0, depending on the modulus. However, if the result was\ninitalised with zero limb space, no limbs space is allocated and a\nNULL-pointer exception ensues.\n\nFix this by allocating a minimal amount of limb space for the result when\nthe 0-exponent case when the result is 1 and not touching the limb space\nwhen the result is 0.\n\nThis affects the use of RSA keys and X.509 certificates that carry them.\n\nBUG: unable to handle kernel NULL pointer dereference at (null)\nIP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\nPGD 0\nOops: 0002 [#1] SMP\nModules linked in:\nCPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278\nHardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014\ntask: ffff8804011944c0 task.stack: ffff880401294000\nRIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\nRSP: 0018:ffff880401297ad8 EFLAGS: 00010212\nRAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0\nRDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0\nRBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000\nR13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50\nFS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0\nStack:\n ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4\n 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30\n ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8\nCall Trace:\n [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66\n [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d\n [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd\n [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146\n [<ffffffff8132a95c>] rsa_verify+0x9d/0xee\n [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb\n [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1\n [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228\n [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4\n [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1\n [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1\n [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61\n [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399\n [<ffffffff812fe227>] SyS_add_key+0x154/0x19e\n [<ffffffff81001c2b>] do_syscall_64+0x80/0x191\n [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25\nCode: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f\nRIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\n RSP <ffff880401297ad8>\nCR2: 0000000000000000\n---[ end trace d82015255d4a5d8d ]---\n\nBasically, this is a backport of a libgcrypt patch:\n\n\thttp://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526\n\nFixes: cdec9cb5167a (\"crypto: GnuPG based MPI lib - source files (part 1)\")\nSigned-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\ncc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>\ncc: linux-ima-devel@lists.sourceforge.net\ncc: stable@vger.kernel.org\nSigned-off-by: James Morris <james.l.morris@oracle.com>\n(cherry picked from commit f5527fffff3f002b0a6b376163613b82f69de073)\nSigned-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>\n---\n lib/mpi/mpi-pow.c | 7 ++++++-\n 1 file changed, 6 insertions(+), 1 deletion(-)", "diff": "diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c\nindex 5464c8744ea9..e24388a863a7 100644\n--- a/lib/mpi/mpi-pow.c\n+++ b/lib/mpi/mpi-pow.c\n@@ -64,8 +64,13 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)\n \tif (!esize) {\n \t\t/* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0\n \t\t * depending on if MOD equals 1. */\n-\t\trp[0] = 1;\n \t\tres->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1;\n+\t\tif (res->nlimbs) {\n+\t\t\tif (mpi_resize(res, 1) < 0)\n+\t\t\t\tgoto enomem;\n+\t\t\trp = res->d;\n+\t\t\trp[0] = 1;\n+\t\t}\n \t\tres->sign = 0;\n \t\tgoto leave;\n \t}\n", "prefixes": [ "Trusty", "SRU", "1/1" ] }