summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorEric Biggers <ebiggers@google.com>2017-10-09 12:51:27 -0700
committerDavid Howells <dhowells@redhat.com>2017-10-12 17:16:40 +0100
commitf66665c09ab489a11ca490d6a82df57cfc1bea3e (patch)
tree8bcdb1a0fa653b839656e246aeefa7484e17a025 /security
parentd60b5b7854c3d135b869f74fb93eaf63cbb1991a (diff)
ecryptfs: fix dereference of NULL user_key_payload
In eCryptfs, we failed to verify that the authentication token keys are not revoked before dereferencing their payloads, which is problematic because the payload of a revoked key is NULL. request_key() *does* skip revoked keys, but there is still a window where the key can be revoked before we acquire the key semaphore. Fix it by updating ecryptfs_get_key_payload_data() to return -EKEYREVOKED if the key payload is NULL. For completeness we check this for "encrypted" keys as well as "user" keys, although encrypted keys cannot be revoked currently. Alternatively we could use key_validate(), but since we'll also need to fix ecryptfs_get_key_payload_data() to validate the payload length, it seems appropriate to just check the payload pointer. Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig") Reviewed-by: James Morris <james.l.morris@oracle.com> Cc: <stable@vger.kernel.org> [v2.6.19+] Cc: Michael Halcrow <mhalcrow@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'security')
0 files changed, 0 insertions, 0 deletions