Re: [PATCH] ubifs: fix out-of-bounds read in signature length check
Richard Weinberger <[email protected]>
| Newsgroups | org.infradead.lists.linux-mtd,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <178648487886.3958324.18328006518346578815.b4-ty@b4> |
On Fri, 24 Jul 2026 09:43:27 +0200, Ibrahim Hashimov wrote:
> ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
> before handing the signature payload to verify_pkcs7_signature(), but the
> check has the wrong sign:
>
> if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))
>
> The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,
> 64 bytes) into the node, so the payload is at most
>
> [...]
Applied, thanks!
[1/1] ubifs: fix out-of-bounds read in signature length check
commit: d68851fbac230fabaeeae25b19fe60ece173da88
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/