Re: [PATCH v2] asymmetric_keys: check asymmetric_key_ids() for NULL before dereference

On Sat, May 02, 2026 at 09:33:29AM -0700, Weiming Shi wrote:
> asymmetric_key_ids() returns key->payload.data[asym_key_ids], which can
> be NULL for keys parsed by the PKCS#8 parser (pkcs8_parser.c explicitly
> stores NULL in prep->payload.data[asym_key_ids]).
> 
> key_or_keyring_common() in restrict.c and find_asymmetric_key() in
> asymmetric_type.c both dereference this return value without checking
> for NULL. An unprivileged user can trigger a NULL pointer dereference
> in key_or_keyring_common() by creating a PKCS#8 key, restricting a
> keyring with key_or_keyring:<pkcs8_serial>, and adding an X.509 cert
> to the restricted keyring. CONFIG_PKCS8_PRIVATE_KEY_PARSER=y is
> required.
> 
> The following bash script can reproduce the issue:
> 
>   #!/bin/bash
>   modprobe pkcs8_key_parser 2>/dev/null
>   openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:1024 \
>       -out /tmp/poc.pem 2>/dev/null
>   openssl pkcs8 -topk8 -nocrypt -in /tmp/poc.pem \
>       -outform DER -out /tmp/poc.p8
>   openssl req -new -x509 -key /tmp/poc.pem -outform DER \
>       -out /tmp/poc.der -days 365 -subj "/CN=Test" \
>       -addext "subjectKeyIdentifier=hash" \
>       -addext "authorityKeyIdentifier=keyid:always" 2>/dev/null
>   PKCS8_ID=$(keyctl padd asymmetric pkcs8key @s < /tmp/poc.p8)
>   KR=$(keyctl newring test_kr @s)
>   keyctl restrict_keyring $KR asymmetric "key_or_keyring:$PKCS8_ID"
>   keyctl padd asymmetric trigger $KR < /tmp/poc.der
>   rm -f /tmp/poc.pem /tmp/poc.p8 /tmp/poc.der
> 
>  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000
>  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
>  RIP: 0010:key_or_keyring_common (crypto/asymmetric_keys/restrict.c:205 crypto/asymmetric_keys/restrict.c:279)
>  Call Trace:
>   <TASK>
>   __key_create_or_update (security/keys/key.c:884)
>   key_create_or_update (security/keys/key.c:1021)
>   __do_sys_add_key (security/keys/keyctl.c:134)
>   do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)
>   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
>   </TASK>
>  Kernel panic - not syncing: Fatal exception
> 
> Add a NULL check in find_asymmetric_key(), mirroring the existing
> pattern in asymmetric_match_key_ids() and asymmetric_key_describe().
> In key_or_keyring_common(), skip the trusted key matching when it
> has no key IDs and fall through to the check_dest path.
> 
> Fixes: 7d30198ee24f ("keys: X.509 public key issuer lookup without AKID")
> Reported-by: Xiang Mei <[email protected]>
> Signed-off-by: Weiming Shi <[email protected]>
> ---
> v2: add bash reproducer to commit message (Ignat)
> 
>  crypto/asymmetric_keys/asymmetric_type.c | 2 ++
>  crypto/asymmetric_keys/restrict.c        | 9 +++++++--
>  2 files changed, 9 insertions(+), 2 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt