linux-stable.git/include/crypto/hash.h, branch linux-4.9.y

crypto: hash - prevent using keyed hashes without setting key

2018-02-25T10:05:44+00:00

commit 9fa68f620041be04720d0cbfb1bd3ddfc6310b24 upstream.

Currently, almost none of the keyed hash algorithms check whether a key
has been set before proceeding.  Some algorithms are okay with this and
will effectively just use a key of all 0's or some other bogus default.
However, others will severely break, as demonstrated using
"hmac(sha3-512-generic)", the unkeyed use of which causes a kernel crash
via a (potentially exploitable) stack buffer overflow.

A while ago, this problem was solved for AF_ALG by pairing each hash
transform with a 'has_key' bool.  However, there are still other places
in the kernel where userspace can specify an arbitrary hash algorithm by
name, and the kernel uses it as unkeyed hash without checking whether it
is really unkeyed.  Examples of this include:

    - KEYCTL_DH_COMPUTE, via the KDF extension
    - dm-verity
    - dm-crypt, via the ESSIV support
    - dm-integrity, via the "internal hash" mode with no key given
    - drbd (Distributed Replicated Block Device)

This bug is especially bad for KEYCTL_DH_COMPUTE as that requires no
privileges to call.

Fix the bug for all users by adding a flag CRYPTO_TFM_NEED_KEY to the
->crt_flags of each hash transform that indicates whether the transform
still needs to be keyed or not.  Then, make the hash init, import, and
digest functions return -ENOKEY if the key is still needed.

The new flag also replaces the 'has_key' bool which algif_hash was
previously using, thereby simplifying the algif_hash implementation.

Reported-by: syzbot 
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: doc - document correct return value for request allocation

2016-04-15T14:35:44+00:00

Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu

crypto: hash - Add helpers to return alg and driver names

2016-02-06T07:33:13+00:00

This patch adds helpers to retrieve the alg name and driver name
of crypto_shash and crypto_ahash objects.

Signed-off-by: Herbert Xu

crypto: hash - Add crypto_has_ahash helper

2016-01-25T14:42:13+00:00

This patch adds the helper crypto_has_ahash which should replace
crypto_has_hash.

Signed-off-by: Herbert Xu

crypto: hash - Add helpers to zero stack request/descriptor

2016-01-25T14:42:11+00:00

As the size of an ahash_request or shash_desc is variable, it's
awkward to zero them explicitly.  This patch adds helpers to do
that which should be used when they are created on the stack.

Signed-off-by: Herbert Xu

crypto: hash - Add crypto_ahash_has_setkey

2016-01-18T10:16:11+00:00

This patch adds a way for ahash users to determine whether a key
is required by a crypto_ahash transform.

Cc: stable@vger.kernel.org
Signed-off-by: Herbert Xu

crypto: ahash - Add crypto_ahash_blocksize

2015-10-20T14:10:48+00:00

This patch adds the missing helper crypto_ahash_blocksize which
returns the block size of an ahash algorithm.

Signed-off-by: Herbert Xu

crypto: hash - Add AHASH_REQUEST_ON_STACK

2015-08-21T14:21:20+00:00

This patch adds the helper AHASH_REQUEST_ON_STACK for those users
of ahash that are synchronous only.

Signed-off-by: Herbert Xu

crypto: doc - Fix typo in crypto-API.xml

2015-06-04T07:05:08+00:00

This patch fix some typos found in crypto-API.xml.
It is because the file is generated from comments in sources,
so I had to fix typo in sources.

Signed-off-by: Masanari Iida 
Acked-by: Stephan Mueller 
Signed-off-by: Herbert Xu

crypto: doc - document uncovered member variables

2014-11-17T14:53:48+00:00

Fix documentation typo for shash_alg->descsize.

Add documentation for initially uncovered member variables.

Signed-off-by: Stephan Mueller 
Signed-off-by: Herbert Xu