github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

crypto: keembay - use crypto_memneq() to compare GCM AEAD tags

Browse Source 
Use crypto_memneq() for constant-time comparison.

The GCM path in keembay-ocs-aes-core.c verifes the received
authentication tag with memcmp(), which returns early on the first
mismatched byte. This leaks valid-prefix length and allows for valid
tag forgery which violates the INT-CTXT guarantee of AEAD.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
David C.C.M. Gall 2026-08-07 18:13:52 +02:00 committed by Herbert Xu
parent 7064af16d2
commit 353b3a8513
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
View File

@ -11,6 +11,7 @@
#include <crypto/internal/aead.h>
#include <crypto/internal/skcipher.h>
#include <crypto/scatterwalk.h>
#include <crypto/utils.h>
#include <linux/clk.h>
#include <linux/completion.h>
#include <linux/dma-mapping.h>
@ -919,7 +920,7 @@ static int kmb_ocs_aead_run(struct aead_request *req)
/* For GCM decrypt, we have to compare in_tag with out_tag. */
if (rctx->instruction == OCS_DECRYPT) {
rc = memcmp(rctx->in_tag, rctx->out_tag, tag_size) ?
rc = crypto_memneq(rctx->in_tag, rctx->out_tag, tag_size) ?
-EBADMSG : 0;
goto exit;
}