From: Ken Goldman <kgold@linux.vnet.ibm.com>
To: linux-ima-devel@lists.sourceforge.net
Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [Linux-ima-devel] [PATCH 0/7] IMA: new parser for ima_restore_measurement_list()
Date: Tue, 23 May 2017 17:00:27 -0400 [thread overview]
Message-ID: <96385c1f-26f9-989b-3b68-0ad261e927b5@linux.vnet.ibm.com> (raw)
In-Reply-To: <3b204e09-c1c0-b3bc-90fe-a8dfb86baadc@huawei.com>
On 5/18/2017 5:38 AM, Roberto Sassu wrote:
>
> There cannot be buffer overflow, because the length of each digest
> field is known.
Crypto Agile: pcr[4] total_digest_len[4]
digest1_len[4] digest1[digest1_len] ...
The way I read this, the digest length is supplied by the caller, which
is slightly different from "known". For example, if I supply a digest
length of 0xffffffff, a too trusting (buggy) parser could overflow the
buffer.
total_digest_len is similarly untrusted. The attacker can send invalid
values.
prev parent reply other threads:[~2017-05-23 21:00 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-16 12:53 Roberto Sassu
2017-05-16 12:53 ` [PATCH 1/7] ima: introduce ima_parse_buf() Roberto Sassu
2017-06-05 5:54 ` [Linux-ima-devel] " Mimi Zohar
2017-05-16 12:53 ` [PATCH 2/7] ima: use ima_parse_buf() to parse measurements headers Roberto Sassu
2017-05-16 12:53 ` [PATCH 3/7] ima: use ima_parse_buf() to parse template data Roberto Sassu
2017-05-16 12:53 ` [PATCH 4/7] ima: declare get_binary_runtime_size() as non-static Roberto Sassu
2017-05-16 12:53 ` [PATCH 5/7] ima: add securityfs interface to save a measurements list with kexec header Roberto Sassu
2017-06-05 6:04 ` [Linux-ima-devel] " Mimi Zohar
2017-06-06 8:49 ` Roberto Sassu
2017-06-06 10:56 ` Mimi Zohar
2017-06-06 12:45 ` Roberto Sassu
2017-06-06 13:23 ` Mimi Zohar
2017-06-13 7:27 ` Roberto Sassu
2017-06-13 12:09 ` Mimi Zohar
2017-06-13 12:37 ` Roberto Sassu
2017-06-06 9:13 ` [Linux-ima-devel] " Roberto Sassu
2017-06-06 11:33 ` Mimi Zohar
2017-05-16 12:53 ` [PATCH 6/7] ima: add securityfs interface to restore a measurements list Roberto Sassu
2017-06-05 5:56 ` [Linux-ima-devel] " Mimi Zohar
2017-05-16 12:53 ` [PATCH 7/7] ima: fix get_binary_runtime_size() Roberto Sassu
2017-05-16 19:00 ` [Linux-ima-devel] [PATCH 0/7] IMA: new parser for ima_restore_measurement_list() Ken Goldman
2017-05-17 7:25 ` Roberto Sassu
2017-05-17 16:28 ` Ken Goldman
2017-05-18 9:38 ` Roberto Sassu
2017-05-23 20:48 ` Ken Goldman
2017-05-24 8:18 ` Roberto Sassu
2017-05-23 21:00 ` Ken Goldman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=96385c1f-26f9-989b-3b68-0ad261e927b5@linux.vnet.ibm.com \
--to=kgold@linux.vnet.ibm.com \
--cc=linux-ima-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®