Re: [PATCH] X.509: Fix validation of ASN.1 certificate header

On Thu, May 14, 2026 at 7:55 AM Lukas Wunner <[email protected]> wrote:
>
> x509_load_certificate_list() seeks to enforce that a certificate starts
> with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256
> and less than 65535 bytes).
>
> But it only enforces that *either* of those two byte values are present,
> instead of checking for the *conjunction* of the two values.  Fix it.
>
> Fixes: 631cc66eb9ea ("MODSIGN: Provide module signing public keys to the kernel")
> Reported-by: Sashiko <[email protected]>
> Closes: https://lore.kernel.org/r/[email protected]/
> Signed-off-by: Lukas Wunner <[email protected]>
> Cc: [email protected] # v3.7+

Reviewed-by: Ignat Korchagin <[email protected]>

> ---
>  crypto/asymmetric_keys/x509_loader.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/crypto/asymmetric_keys/x509_loader.c b/crypto/asymmetric_keys/x509_loader.c
> index a417413..0d516c7 100644
> --- a/crypto/asymmetric_keys/x509_loader.c
> +++ b/crypto/asymmetric_keys/x509_loader.c
> @@ -20,7 +20,7 @@ int x509_load_certificate_list(const u8 cert_list[],
>                  */
>                 if (end - p < 4)
>                         goto dodgy_cert;
> -               if (p[0] != 0x30 &&
> +               if (p[0] != 0x30 ||

Whoa! Nice catch...

>                     p[1] != 0x82)
>                         goto dodgy_cert;
>                 plen = (p[2] << 8) | p[3];
> --
> 2.51.0
>
>