From: Greg Kroah-Hartman Date: Sat, 24 Oct 2020 10:40:46 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.4.241~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9bd69a54cefb76296966626cb67dd2db7cad1d09;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ima-don-t-ignore-errors-from-crypto_shash_update.patch --- diff --git a/queue-4.4/ima-don-t-ignore-errors-from-crypto_shash_update.patch b/queue-4.4/ima-don-t-ignore-errors-from-crypto_shash_update.patch new file mode 100644 index 00000000000..2d0b05afd1e --- /dev/null +++ b/queue-4.4/ima-don-t-ignore-errors-from-crypto_shash_update.patch @@ -0,0 +1,35 @@ +From 60386b854008adc951c470067f90a2d85b5d520f Mon Sep 17 00:00:00 2001 +From: Roberto Sassu +Date: Fri, 4 Sep 2020 11:23:28 +0200 +Subject: ima: Don't ignore errors from crypto_shash_update() + +From: Roberto Sassu + +commit 60386b854008adc951c470067f90a2d85b5d520f upstream. + +Errors returned by crypto_shash_update() are not checked in +ima_calc_boot_aggregate_tfm() and thus can be overwritten at the next +iteration of the loop. This patch adds a check after calling +crypto_shash_update() and returns immediately if the result is not zero. + +Cc: stable@vger.kernel.org +Fixes: 3323eec921efd ("integrity: IMA as an integrity service provider") +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_crypto.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -555,6 +555,8 @@ static int __init ima_calc_boot_aggregat + ima_pcrread(i, pcr_i); + /* now accumulate with current aggregate */ + rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE); ++ if (rc != 0) ++ return rc; + } + if (!rc) + crypto_shash_final(shash, digest); diff --git a/queue-4.4/series b/queue-4.4/series index c81da66daad..a5a86d092c6 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -15,3 +15,4 @@ nfc-ensure-presence-of-nfc_attr_firmware_name-attribute-in-nfc_genl_fw_download. tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch icmp-randomize-the-global-rate-limiter.patch cifs-remove-bogus-debug-code.patch +ima-don-t-ignore-errors-from-crypto_shash_update.patch