qiurui/Centos-kernel-stream-9
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge: CVE-2026-63824 kernel: KEYS: fix overflow in keyctl_pkey_params_get_2()

Browse Source 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/8591

JIRA: https://redhat.atlassian.net/browse/RHEL-229620
CVE: CVE-2026-63824

The length for the internal output buffer is calculated incorrectl in
keyctl_pkey_params_get_2(), but to fix it we also bring another commit to
prepare the tree and allow a clean backport of the CVE fix.

Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>

Approved-by: Thomas Huth <thuth@redhat.com>
Approved-by: Ricardo Robaina <rrobaina@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
This commit is contained in:
CKI KWF Bot
2026-08-31 17:16:12 +00:00
parent 838155400a 5e6026bd08
commit 0974d7f613
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/keys/keyctl_pkey.c
+19 -4
View File
@@ -135,23 +135,38 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par
switch (op) {
case KEYCTL_PKEY_ENCRYPT:
if (uparams.in_len > info.max_dec_size ||
uparams.out_len > info.max_enc_size)
return -EINVAL;
params->out_len = info.max_enc_size;
break;
case KEYCTL_PKEY_DECRYPT:
if (uparams.in_len > info.max_enc_size ||
uparams.out_len > info.max_dec_size)
return -EINVAL;
params->out_len = info.max_dec_size;
break;
case KEYCTL_PKEY_SIGN:
case KEYCTL_PKEY_VERIFY:
if (uparams.in_len > info.max_sig_size ||
uparams.out_len > info.max_data_size)
if (uparams.in_len > info.max_data_size ||
uparams.out_len > info.max_sig_size)
return -EINVAL;
params->out_len = info.max_sig_size;
break;
case KEYCTL_PKEY_VERIFY:
if (uparams.in_len > info.max_data_size ||
uparams.in2_len > info.max_sig_size)
return -EINVAL;
params->out_len = info.max_sig_size;
break;
default:
BUG();
}
params->in_len = uparams.in_len;
params->out_len = uparams.out_len;
return 0;
}