Re: [PATCH] X.509: Fix validation of ASN.1 certificate header
Herbert Xu <[email protected]> Fri, 22 May 2026 20:30:37 +0800
| Newsgroups | org.kernel.vger.keyrings,org.kernel.vger.linux-crypto |
|---|---|
| Message-ID | <[email protected]> |
On Thu, May 14, 2026 at 08:55:58AM +0200, Lukas Wunner wrote:
> x509_load_certificate_list() seeks to enforce that a certificate starts
> with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256
> and less than 65535 bytes).
>
> But it only enforces that *either* of those two byte values are present,
> instead of checking for the *conjunction* of the two values. Fix it.
>
> Fixes: 631cc66eb9ea ("MODSIGN: Provide module signing public keys to the kernel")
> Reported-by: Sashiko <[email protected]>
> Closes: https://lore.kernel.org/r/[email protected]/
> Signed-off-by: Lukas Wunner <[email protected]>
> Cc: [email protected] # v3.7+
> ---
> crypto/asymmetric_keys/x509_loader.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Patch applied. Thanks.
--
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt