qiurui/Centos-kernel-stream-9
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

crypto: akcipher - Disable signing and decryption

Browse Source 
JIRA: https://issues.redhat.com/browse/RHEL-17113
Upstream Status: RHEL only
CVE: CVE-2023-6240

The decryption and signing capabilities are never used within the
kernel.  However, they are exposed to user-space through the keyctl
system call.

As these operations may cause security issues, disable them by
stubbing out the relevant entry points.

Signed-off-by: Herbert Xu <herbert.xu@redhat.com>
This commit is contained in:
Herbert Xu
2024-02-15 11:47:40 +08:00
parent fd8b9bcd59
commit 3709c35cf1
2 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crypto/akcipher.c
+2 -4
View File
@@ -124,14 +124,12 @@ int crypto_register_akcipher(struct akcipher_alg *alg)
{
struct crypto_alg *base = &alg->base;
if (!alg->sign)
alg->sign = akcipher_default_op;
alg->sign = akcipher_default_op;
if (!alg->verify)
alg->verify = akcipher_default_op;
if (!alg->encrypt)
alg->encrypt = akcipher_default_op;
if (!alg->decrypt)
alg->decrypt = akcipher_default_op;
alg->decrypt = akcipher_default_op;
akcipher_prepare_alg(alg);
return crypto_register_alg(base);
crypto/testmgr.c
+1 -1
View File
@@ -4159,7 +4159,7 @@ static int test_akcipher_one(struct crypto_akcipher *tfm,
* Don't invoke (decrypt or sign) test which require a private key
* for vectors with only a public key.
*/
if (vecs->public_key_vec) {
if (1 || vecs->public_key_vec) {
err = 0;
goto free_all;
}