Commit eed0e3d3 authored by Eric Biggers's avatar Eric Biggers Committed by Jarkko Sakkinen
Browse files

KEYS: trusted_tpm1: Compare HMAC values in constant time 



To prevent timing attacks, HMAC value comparison needs to be constant
time.  Replace the memcmp() with the correct function, crypto_memneq().

[For the Fixes commit I used the commit that introduced the memcmp().
It predates the introduction of crypto_memneq(), but it was still a bug
at the time even though a helper function didn't exist yet.]

Fixes: d00a1c72 ("keys: add new trusted key-type")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarEric Biggers <ebiggers@kernel.org>
Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
parent fec734e8

security/keys/trusted-keys/trusted_tpm1.c

+4 −3
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ 
 */



#include <crypto/hash_info.h>

#include <crypto/utils.h>

#include <linux/init.h>

#include <linux/slab.h>

#include <linux/parser.h>
@@ -241,7 +242,7 @@ int TSS_checkhmac1(unsigned char *buffer, 
	if (ret < 0)

		goto out;



	if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE))

	if (crypto_memneq(testhmac, authdata, SHA1_DIGEST_SIZE))

		ret = -EINVAL;

out:

	kfree_sensitive(sdesc);
@@ -334,7 +335,7 @@ static int TSS_checkhmac2(unsigned char *buffer, 
			  TPM_NONCE_SIZE, ononce, 1, continueflag1, 0, 0);

	if (ret < 0)

		goto out;

	if (memcmp(testhmac1, authdata1, SHA1_DIGEST_SIZE)) {

	if (crypto_memneq(testhmac1, authdata1, SHA1_DIGEST_SIZE)) {

		ret = -EINVAL;

		goto out;

	}
@@ -343,7 +344,7 @@ static int TSS_checkhmac2(unsigned char *buffer, 
			  TPM_NONCE_SIZE, ononce, 1, continueflag2, 0, 0);

	if (ret < 0)

		goto out;

	if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE))

	if (crypto_memneq(testhmac2, authdata2, SHA1_DIGEST_SIZE))

		ret = -EINVAL;

out:

	kfree_sensitive(sdesc);