diff mbox series

[v3,02/10] certs: Fix blacklisted hexadecimal hash string check

Message ID 20210114151909.2344974-3-mic@digikod.net
State Superseded
Headers show
Series Enable root to update the blacklist keyring | expand

Commit Message

Mickaël Salaün Jan. 14, 2021, 3:19 p.m. UTC
From: Mickaël Salaün <mic@linux.microsoft.com>

When looking for a blacklisted hash, bin2hex() is used to transform a
binary hash to an ascii (lowercase) hexadecimal string.  This string is
then search for in the description of the keys from the blacklist
keyring.  When adding a key to the blacklist keyring,
blacklist_vet_description() checks the hash prefix and the hexadecimal
string, but not that this string is lowercase.  It is then valid to set
hashes with uppercase hexadecimal, which will be silently ignored by the
kernel.

Add an additional check to blacklist_vet_description() to check that
hexadecimal strings are in lowercase.

Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Ben Boeckel <mathstuf@gmail.com>
---

Changes since v2:
* Cherry-pick v1 patch from
  https://lore.kernel.org/lkml/2659836.1607940186@warthog.procyon.org.uk/
  to rebase on v5.11-rc3.
* Rearrange Cc order.
---
 certs/blacklist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Jarkko Sakkinen Jan. 20, 2021, 3:43 a.m. UTC | #1
On Thu, Jan 14, 2021 at 04:19:01PM +0100, Mickaël Salaün wrote:
> From: Mickaël Salaün <mic@linux.microsoft.com>

> 

> When looking for a blacklisted hash, bin2hex() is used to transform a

> binary hash to an ascii (lowercase) hexadecimal string.  This string is

> then search for in the description of the keys from the blacklist

> keyring.  When adding a key to the blacklist keyring,

> blacklist_vet_description() checks the hash prefix and the hexadecimal

> string, but not that this string is lowercase.  It is then valid to set

> hashes with uppercase hexadecimal, which will be silently ignored by the

> kernel.

> 

> Add an additional check to blacklist_vet_description() to check that

> hexadecimal strings are in lowercase.

> 

> Cc: David Woodhouse <dwmw2@infradead.org>

> Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>

> Signed-off-by: David Howells <dhowells@redhat.com>

> Reviewed-by: Ben Boeckel <mathstuf@gmail.com>

> ---

> 

> Changes since v2:

> * Cherry-pick v1 patch from

>   https://lore.kernel.org/lkml/2659836.1607940186@warthog.procyon.org.uk/

>   to rebase on v5.11-rc3.

> * Rearrange Cc order.

> ---

>  certs/blacklist.c | 2 +-

>  1 file changed, 1 insertion(+), 1 deletion(-)

> 

> diff --git a/certs/blacklist.c b/certs/blacklist.c

> index 2719fb2fbc1c..a888b934a1cd 100644

> --- a/certs/blacklist.c

> +++ b/certs/blacklist.c

> @@ -37,7 +37,7 @@ static int blacklist_vet_description(const char *desc)

>  found_colon:

>  	desc++;

>  	for (; *desc; desc++) {

> -		if (!isxdigit(*desc))

> +		if (!isxdigit(*desc) || isupper(*desc))

>  			return -EINVAL;

>  		n++;

>  	}

> -- 

> 2.30.0

> 


Shouldn't this rather convert the upper case to lower case? I don't like
the ABI break that this causes.

/Jarkko
Mickaël Salaün Jan. 20, 2021, 11:12 a.m. UTC | #2
On 20/01/2021 04:43, Jarkko Sakkinen wrote:
> On Thu, Jan 14, 2021 at 04:19:01PM +0100, Mickaël Salaün wrote:

>> From: Mickaël Salaün <mic@linux.microsoft.com>

>>

>> When looking for a blacklisted hash, bin2hex() is used to transform a

>> binary hash to an ascii (lowercase) hexadecimal string.  This string is

>> then search for in the description of the keys from the blacklist

>> keyring.  When adding a key to the blacklist keyring,

>> blacklist_vet_description() checks the hash prefix and the hexadecimal

>> string, but not that this string is lowercase.  It is then valid to set

>> hashes with uppercase hexadecimal, which will be silently ignored by the

>> kernel.

>>

>> Add an additional check to blacklist_vet_description() to check that

>> hexadecimal strings are in lowercase.

>>

>> Cc: David Woodhouse <dwmw2@infradead.org>

>> Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>

>> Signed-off-by: David Howells <dhowells@redhat.com>

>> Reviewed-by: Ben Boeckel <mathstuf@gmail.com>

>> ---

>>

>> Changes since v2:

>> * Cherry-pick v1 patch from

>>   https://lore.kernel.org/lkml/2659836.1607940186@warthog.procyon.org.uk/

>>   to rebase on v5.11-rc3.

>> * Rearrange Cc order.

>> ---

>>  certs/blacklist.c | 2 +-

>>  1 file changed, 1 insertion(+), 1 deletion(-)

>>

>> diff --git a/certs/blacklist.c b/certs/blacklist.c

>> index 2719fb2fbc1c..a888b934a1cd 100644

>> --- a/certs/blacklist.c

>> +++ b/certs/blacklist.c

>> @@ -37,7 +37,7 @@ static int blacklist_vet_description(const char *desc)

>>  found_colon:

>>  	desc++;

>>  	for (; *desc; desc++) {

>> -		if (!isxdigit(*desc))

>> +		if (!isxdigit(*desc) || isupper(*desc))

>>  			return -EINVAL;

>>  		n++;

>>  	}

>> -- 

>> 2.30.0

>>

> 

> Shouldn't this rather convert the upper case to lower case? I don't like

> the ABI break that this causes.


It doesn't break the ABI because keys loaded in the blacklist keyring
can only happen with builtin hashes.  Moreover these builtin hashes will
be checked by patch 10/10 at build time.

This patch is also important to remove a false sense of security and
warns about mis-blacklisted certificates or binaries:
https://lore.kernel.org/lkml/c9664a67-61b7-6b4a-86d7-5aca9ff06fa5@digikod.net/

Hot-patching keys doesn't seem a good idea, especially when these keys
are signed. Moreover, it would bring additional complexity and will
require to change the core of the key management.

> 

> /Jarkko

>
Jarkko Sakkinen Jan. 20, 2021, 11:44 p.m. UTC | #3
On Wed, Jan 20, 2021 at 12:12:50PM +0100, Mickaël Salaün wrote:
> 

> On 20/01/2021 04:43, Jarkko Sakkinen wrote:

> > On Thu, Jan 14, 2021 at 04:19:01PM +0100, Mickaël Salaün wrote:

> >> From: Mickaël Salaün <mic@linux.microsoft.com>

> >>

> >> When looking for a blacklisted hash, bin2hex() is used to transform a

> >> binary hash to an ascii (lowercase) hexadecimal string.  This string is

> >> then search for in the description of the keys from the blacklist

> >> keyring.  When adding a key to the blacklist keyring,

> >> blacklist_vet_description() checks the hash prefix and the hexadecimal

> >> string, but not that this string is lowercase.  It is then valid to set

> >> hashes with uppercase hexadecimal, which will be silently ignored by the

> >> kernel.

> >>

> >> Add an additional check to blacklist_vet_description() to check that

> >> hexadecimal strings are in lowercase.

> >>

> >> Cc: David Woodhouse <dwmw2@infradead.org>

> >> Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>

> >> Signed-off-by: David Howells <dhowells@redhat.com>

> >> Reviewed-by: Ben Boeckel <mathstuf@gmail.com>

> >> ---

> >>

> >> Changes since v2:

> >> * Cherry-pick v1 patch from

> >>   https://lore.kernel.org/lkml/2659836.1607940186@warthog.procyon.org.uk/

> >>   to rebase on v5.11-rc3.

> >> * Rearrange Cc order.

> >> ---

> >>  certs/blacklist.c | 2 +-

> >>  1 file changed, 1 insertion(+), 1 deletion(-)

> >>

> >> diff --git a/certs/blacklist.c b/certs/blacklist.c

> >> index 2719fb2fbc1c..a888b934a1cd 100644

> >> --- a/certs/blacklist.c

> >> +++ b/certs/blacklist.c

> >> @@ -37,7 +37,7 @@ static int blacklist_vet_description(const char *desc)

> >>  found_colon:

> >>  	desc++;

> >>  	for (; *desc; desc++) {

> >> -		if (!isxdigit(*desc))

> >> +		if (!isxdigit(*desc) || isupper(*desc))

> >>  			return -EINVAL;

> >>  		n++;

> >>  	}

> >> -- 

> >> 2.30.0

> >>

> > 

> > Shouldn't this rather convert the upper case to lower case? I don't like

> > the ABI break that this causes.

> 

> It doesn't break the ABI because keys loaded in the blacklist keyring

> can only happen with builtin hashes.  Moreover these builtin hashes will

> be checked by patch 10/10 at build time.


Right the patches are just out of order then.

/Jarkko

> 

> This patch is also important to remove a false sense of security and

> warns about mis-blacklisted certificates or binaries:

> https://lore.kernel.org/lkml/c9664a67-61b7-6b4a-86d7-5aca9ff06fa5@digikod.net/

> 

> Hot-patching keys doesn't seem a good idea, especially when these keys

> are signed. Moreover, it would bring additional complexity and will

> require to change the core of the key management.

> 

> > 

> > /Jarkko

> > 

>
diff mbox series

Patch

diff --git a/certs/blacklist.c b/certs/blacklist.c
index 2719fb2fbc1c..a888b934a1cd 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -37,7 +37,7 @@  static int blacklist_vet_description(const char *desc)
 found_colon:
 	desc++;
 	for (; *desc; desc++) {
-		if (!isxdigit(*desc))
+		if (!isxdigit(*desc) || isupper(*desc))
 			return -EINVAL;
 		n++;
 	}