Commit 923168a0 authored by Samasth Norway Ananda's avatar Samasth Norway Ananda Committed by Mimi Zohar
Browse files

ima: fix buffer overrun in ima_eventdigest_init_common 



Function ima_eventdigest_init() calls ima_eventdigest_init_common()
with HASH_ALGO__LAST which is then used to access the array
hash_digest_size[] leading to buffer overrun. Have a conditional
statement to handle this.

Fixes: 9fab303a ("ima: fix violation measurement list record")
Signed-off-by: default avatarSamasth Norway Ananda <samasth.norway.ananda@oracle.com>
Tested-by: default avatarEnrico Bravi (PhD at polito.it) <enrico.bravi@huawei.com>
Cc: stable@vger.kernel.org # 5.19+
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 8cf0b939

security/integrity/ima/ima_template_lib.c

+10 −4
Original line number Diff line number Diff line
@@ -318,15 +318,21 @@ static int ima_eventdigest_init_common(const u8 *digest, u32 digestsize, 
				      hash_algo_name[hash_algo]);

	}



	if (digest)

	if (digest) {

		memcpy(buffer + offset, digest, digestsize);

	else

	} else {

		/*

		 * If digest is NULL, the event being recorded is a violation.

		 * Make room for the digest by increasing the offset by the

		 * hash algorithm digest size.

		 * hash algorithm digest size. If the hash algorithm is not

		 * specified increase the offset by IMA_DIGEST_SIZE which

		 * fits SHA1 or MD5

		 */

		if (hash_algo < HASH_ALGO__LAST)

			offset += hash_digest_size[hash_algo];

		else

			offset += IMA_DIGEST_SIZE;

	}



	return ima_write_template_field_data(buffer, offset + digestsize,

					     fmt, field_data);