github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-09 13:44:03 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

crypto: octeontx - use crypto_memneq() to check HMAC

Browse Source 
validate_hmac_cipher_null() compares the computed and received HMAC
with memcmp(), which short-circuits on the first differing byte and
leaks tag-match length via timing. Use crypto_memneq() instead.

Because for cipher_null the validated payload is un-encrypted, this
valid prefix leak allows for authenticated message forgery.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
David C.C.M. Gall 2026-08-15 19:09:14 +02:00 committed by Herbert Xu
parent aaab228443
commit caad4d7cbc
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
View File

@ -16,6 +16,7 @@
#include <crypto/sha1.h>
#include <crypto/sha2.h>
#include <crypto/xts.h>
#include <crypto/utils.h>
#include <crypto/scatterwalk.h>
#include <linux/sort.h>
#include <linux/module.h>
@ -105,9 +106,9 @@ static inline int validate_hmac_cipher_null(struct otx_cpt_req_info *cpt_req)
req = container_of(cpt_req->areq, struct aead_request, base);
tfm = crypto_aead_reqtfm(req);
rctx = aead_request_ctx_dma(req);
if (memcmp(rctx->fctx.hmac.s.hmac_calc,
rctx->fctx.hmac.s.hmac_recv,
crypto_aead_authsize(tfm)) != 0)
if (crypto_memneq(rctx->fctx.hmac.s.hmac_calc,
rctx->fctx.hmac.s.hmac_recv,
crypto_aead_authsize(tfm)))
return -EBADMSG;
return 0;