From 4cf50332b5384ea13f6f896d5cf84e05b5b6484a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= Date: Wed, 26 Aug 2026 10:37:43 +0000 Subject: [PATCH] crypto: rsassa-pkcs1 - reject undersized keys when signing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rsassa_pkcs1_sign() subtracts 11 from the unsigned key size before checking that the key is large enough for PKCS#1 v1.5 padding: if (slen + hash_prefix->size > ctx->key_size - 11) return -EOVERFLOW; If the RSA modulus is shorter than 11 bytes, the subtraction wraps. With a one-byte key and hash=none, the padding memset() writes past the output buffer. KASAN reports: BUG: KASAN: slab-out-of-bounds in rsassa_pkcs1_sign+0x1ad/0x3b0 Write of size 4294967294 at addr ... The buggy address is located 0 bytes to the right of allocated 1-byte region [...] Reject keys shorter than the minimum encoded message size. Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm") Assisted-by: Codex:gpt-5 Signed-off-by: Jérémy Jean Reviewed-by: Sudhakar Kuppusamy Signed-off-by: Herbert Xu --- crypto/rsassa-pkcs1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/rsassa-pkcs1.c b/crypto/rsassa-pkcs1.c index 94fa5e9600e7..d0e4a885397f 100644 --- a/crypto/rsassa-pkcs1.c +++ b/crypto/rsassa-pkcs1.c @@ -169,7 +169,7 @@ static int rsassa_pkcs1_sign(struct crypto_sig *tfm, u8 *in_buf; int err; - if (!ctx->key_size) + if (ctx->key_size < 11) return -EINVAL; if (dlen < ctx->key_size)