kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Fix file size checking in read_secure_key()

Browse Source 
Key files read by read_secure_key() may not be just a key blob, but it
might also contain an additional integrity key blob.

Correct the upper bounds checking and allow up to 3 key blobs to be read.
This allows for an AES-XTS key blob consisting of 2 key blobs plus an
integrity key blob concatenated to the encryption key blob.

Fixes: 771c794580 ("zkey-cryptsetup: Support PHMAC integrity with setkey command")
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-09 09:34:18 +02:00
committed by Jan Höppner
parent 604c34e66b
commit 610cc581da
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
zkey/pkey.c
View File

@@ -100,7 +100,7 @@ u8 *read_secure_key(const char *keyfile, size_t *secure_key_size,
}
size = sb.st_size;
if (size < MIN_SECURE_KEY_SIZE || size > 2 * MAX_SECURE_KEY_SIZE) {
if (size < MIN_SECURE_KEY_SIZE || size > 3 * MAX_SECURE_KEY_SIZE) {
warnx("File '%s' has an invalid size: %lu", keyfile, size);
return NULL;
}