From 8fecaad77fb9e076daa462ac1596330a604e23ad Mon Sep 17 00:00:00 2001 From: Stephan Mueller Date: Tue, 1 Jul 2014 17:08:48 +0200 Subject: crypto: drbg - fix memory corruption for AES192 For the CTR DRBG, the drbg_state->scratchpad temp buffer (i.e. the memory location immediately before the drbg_state->tfm variable is the buffer that the BCC function operates on. BCC operates blockwise. Making the temp buffer drbg_statelen(drbg) in size is sufficient when the DRBG state length is a multiple of the block size. For AES192 this is not the case and the length for temp is insufficient (yes, that also means for such ciphers, the final output of all BCC rounds are truncated before used to update the state of the DRBG!!). The patch enlarges the temp buffer from drbg_statelen to drbg_statelen + drbg_blocklen to have sufficient space. Reported-by: Fengguang Wu Signed-off-by: Stephan Mueller Signed-off-by: Herbert Xu --- crypto/drbg.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'crypto/drbg.c') diff --git a/crypto/drbg.c b/crypto/drbg.c index 99fa8f89fb3e..3f0b7e0f8bac 100644 --- a/crypto/drbg.c +++ b/crypto/drbg.c @@ -446,8 +446,16 @@ static int drbg_ctr_bcc(struct drbg_state *drbg, * length: drbg_blocklen(drbg) * temp * start: iv + drbg_blocklen(drbg) - * length: (drbg_keylen(drbg) + drbg_blocklen(drbg) == - * drbg_statelen(drbg)) + * length: drbg_satelen(drbg) + drbg_blocklen(drbg) + * note: temp is the buffer that the BCC function operates + * on. BCC operates blockwise. drbg_statelen(drbg) + * is sufficient when the DRBG state length is a multiple + * of the block size. For AES192 (and maybe other ciphers) + * this is not correct and the length for temp is + * insufficient (yes, that also means for such ciphers, + * the final output of all BCC rounds are truncated). + * Therefore, add drbg_blocklen(drbg) to cover all + * possibilities. */ /* Derivation Function for CTR DRBG as defined in 10.4.2 */ @@ -1205,7 +1213,7 @@ static inline int drbg_alloc_state(struct drbg_state *drbg) drbg_statelen(drbg) + /* df_data */ drbg_blocklen(drbg) + /* pad */ drbg_blocklen(drbg) + /* iv */ - drbg_statelen(drbg); /* temp */ + drbg_statelen(drbg) + drbg_blocklen(drbg); /* temp */ else sb_size = drbg_statelen(drbg) + drbg_blocklen(drbg); -- cgit v1.2.3-59-g8ed1b