Re: [PATCH] X.509: Fix out-of-bounds access when parsing extensions

On Tue, Apr 07, 2026 at 12:58:18PM +0200, Lukas Wunner wrote:
> Leo reports an out-of-bounds access when parsing a certificate with
> empty Basic Constraints or Key Usage extension because the first byte of
> the extension is read before checking its length.  Fix it.
> 
> The bug can be triggered by an unprivileged user by submitting a
> specially crafted certificate to the kernel through the keyrings(7) API.
> Leo has demonstrated this with a proof-of-concept program responsibly
> disclosed off-list.
> 
> Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
> Fixes: 567671281a75 ("KEYS: X.509: Parse Key Usage")
> Reported-by: Leo Lin <[email protected]> # off-list
> Signed-off-by: Lukas Wunner <[email protected]>
> Reviewed-by: Ignat Korchagin <[email protected]>
> Cc: [email protected] # v6.4+
> ---
>  crypto/asymmetric_keys/x509_cert_parser.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt