In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ubifs: fix out-of-bounds read in signature length check<\/p>\n
ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
\nbefore handing the signature payload to verify_pkcs7_signature(), but the
\ncheck has the wrong sign:<\/p>\n
\tif (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))<\/p>\n
The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,
\n64 bytes) into the node, so the payload is at most<\/p>\n
\tsnod->len – sizeof(struct ubifs_sig_node)<\/p>\n
bytes long. Adding the header size instead of subtracting it accepts a
\ndeclared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually
\nholds — past the end of c->sbuf, which is vmalloc(c->leb_size).
\nverify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()
\nis then handed that inflated length and reads beyond the allocation while
\nwalking the DER headers. The node length comes straight from the mounted
\nimage, so a crafted signed UBIFS image reaches this via
\nubifs_read_superblock() before the signature is cryptographically checked.<\/p>\n
snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner
\n(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected
\nsubtraction cannot underflow. Legitimately signed images are unaffected: a
\ncorrect superblock never declares a signature longer than the node it is
\nembedded in.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ubifs: fix out-of-bounds read in signature length check<\/p>\n
ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
\nb<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21642","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}