github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-09 13:44:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

crypto: octeontx2 - use crypto_memneq() to check HMAC for cipher_null authenc

Browse Source 
validate_hmac_cipher_null() compares the computed and received HMAC
with memcmp(), which short-circuits on the first differing byte and
leaks tag-match length via timing. Use crypto_memneq() instead.

Because for cipher_null the validated payload is un-encrypted, this
valid prefix leak allows for authenticated message forgery.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
David C.C.M. Gall 2026-08-15 19:08:21 +02:00 committed by Herbert Xu
parent 844de21437
commit aaab228443
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
View File

@ -11,6 +11,7 @@
#include <crypto/xts.h>
#include <crypto/gcm.h>
#include <crypto/scatterwalk.h>
#include <crypto/utils.h>
#include <linux/sort.h>
#include <linux/module.h>
#include "otx2_cptvf.h"
@ -90,9 +91,9 @@ static inline int validate_hmac_cipher_null(struct otx2_cpt_req_info *cpt_req)
req = container_of(cpt_req->areq, struct aead_request, base);
tfm = crypto_aead_reqtfm(req);
rctx = aead_request_ctx_dma(req);
if (memcmp(rctx->fctx.hmac.s.hmac_calc,
rctx->fctx.hmac.s.hmac_recv,
crypto_aead_authsize(tfm)) != 0)
if (crypto_memneq(rctx->fctx.hmac.s.hmac_calc,
rctx->fctx.hmac.s.hmac_recv,
crypto_aead_authsize(tfm)))
return -EBADMSG;
return 0;