From 7dc44840ca3cface30985fc93da37284ed1feeb5 Mon Sep 17 00:00:00 2001 From: Doruk Tan Ozturk Date: Mon, 20 Jul 2026 21:15:25 +0200 Subject: [PATCH] crypto: rsa-pkcs1pad: Don't WARN on an empty digest KEYCTL_PKEY_VERIFY lets an unprivileged caller supply a zero-length digest (in_len == 0). keyctl_pkey_params_get_2() accepts the zero length and the request reaches pkcs1pad_verify(), where the empty digest is rejected but only after being passed through WARN_ON(!digest_size). The warning is therefore directly user-triggerable, and on kernels built with panic_on_warn=1 an unprivileged process can panic the machine -- a local denial of service. Reproduced as UID 65534 in a setuid sandbox. Keep rejecting the invalid request with -EINVAL, but do not emit a warning for the user-controlled length. Mainline does not contain this code path; commit 1e562deacecc ("crypto: rsassa-pkcs1 - Migrate to sig_alg backend") removed pkcs1pad_verify() in v6.13-rc1. This is a minimal fix for the affected stable branches. It applies as-is to 6.1.y, 6.6.y and 6.12.y (identical pkcs1pad_verify); the 5.10.y/5.15.y form is sent as a separate patch due to the older req->dst_len spelling. Found by 0sec automated security-research tooling (https://0sec.ai). Fixes: c7381b012872 ("crypto: akcipher - new verify API for public key algorithms") Cc: stable@vger.kernel.org Assisted-by: 0sec:multi-model Signed-off-by: Doruk Tan Ozturk Reviewed-by: Lukas Wunner Signed-off-by: Sasha Levin --- crypto/rsa-pkcs1pad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c index d2e5e104f8cf..8172f0b0b481 100644 --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -534,7 +534,7 @@ static int pkcs1pad_verify(struct akcipher_request *req) const unsigned int digest_size = req->dst_len; int err; - if (WARN_ON(req->dst) || WARN_ON(!digest_size) || + if (WARN_ON(req->dst) || !digest_size || !ctx->key_size || sig_size != ctx->key_size) return -EINVAL;