Taeyang Lee df22c9a65e crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec ...

[ Upstream commit 2397e92646 ]

authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than
the minimum expected length, crypto_authenc_esn_decrypt() can advance past
the end of the destination scatterlist and trigger a NULL pointer dereference
in scatterwalk_map_and_copy(), leading to a kernel panic (DoS).

Add a minimum AAD length check to fail fast on invalid inputs.

Fixes: 104880a6b4 ("crypto: authencesn - Convert to new AEAD interface")
Reported-By: Taeyang Lee <0wn@theori.io>
Signed-off-by: Taeyang Lee <0wn@theori.io>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-02-06 16:40:04 +01:00

..

asymmetric_keys

crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

2026-01-19 13:11:28 +01:00

async_tx

async_xor: check src_offs is not NULL before updating it

2021-06-16 12:01:40 +02:00

842.c

…

acompress.c

…

adiantum.c

…

aead.c

crypto: aead,cipher - zeroize key buffer after use

2024-07-18 13:05:38 +02:00

aegis128-core.c

…

aegis128-neon-inner.c

…

aegis128-neon.c

…

aegis.h

…

aes_generic.c

…

aes_ti.c

…

af_alg.c

crypto: af_alg - zero initialize memory allocated via sock_kmalloc

2026-01-19 13:12:04 +01:00

ahash.c

…

akcipher.c

crypto: akcipher - default implementation for setting a private key

2022-10-26 13:25:42 +02:00

algapi.c

Revert "crypto: api - Disallow identical driver names"

2024-05-02 16:23:43 +02:00

algboss.c

exit: Rename module_put_and_exit to module_put_and_kthread_exit

2024-06-21 14:53:29 +02:00

algif_aead.c

…

algif_hash.c

crypto: af_alg - zero initialize memory allocated via sock_kmalloc

2026-01-19 13:12:04 +01:00

algif_rng.c

crypto: af_alg - zero initialize memory allocated via sock_kmalloc

2026-01-19 13:12:04 +01:00

algif_skcipher.c

…

ansi_cprng.c

…

anubis.c

…

api.c

crypto: api - Move cryptomgr soft dependency into algapi

2022-02-11 09:09:03 +01:00

arc4.c

…

authenc.c

crypto: authenc - Fix sleep in atomic context in decrypt_tail

2022-04-08 14:39:59 +02:00

authencesn.c

crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec

2026-02-06 16:40:04 +01:00

blake2b_generic.c

…

blake2s_generic.c

lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI

2022-05-30 09:33:26 +02:00

blowfish_common.c

…

blowfish_generic.c

…

camellia_generic.c

…

cast5_generic.c

…

cast6_generic.c

…

cast_common.c

…

cbc.c

…

ccm.c

…

cfb.c

…

chacha20poly1305.c

…

chacha_generic.c

…

cipher.c

crypto: aead,cipher - zeroize key buffer after use

2024-07-18 13:05:38 +02:00

cmac.c

…

compress.c

…

crc32_generic.c

…

crc32c_generic.c

…

crct10dif_common.c

…

crct10dif_generic.c

…

cryptd.c

crypto: cryptd - Use request context instead of stack for sub-request

2023-01-14 10:15:49 +01:00

crypto_engine.c

…

crypto_null.c

crypto: null - Use spin lock instead of mutex

2025-05-02 07:41:18 +02:00

crypto_user_base.c

…

crypto_user_stat.c

…

ctr.c

…

cts.c

…

curve25519-generic.c

…

deflate.c

…

des_generic.c

…

dh_helper.c

…

dh.c

…

drbg.c

crypto: drbg - Only fail when jent is unavailable in FIPS mode

2023-05-17 11:47:50 +02:00

ecb.c

…

ecc_curve_defs.h

…

ecc.c

…

ecc.h

…

ecdh_helper.c

…

ecdh.c

…

echainiv.c

…

ecrdsa_defs.h

…

ecrdsa_params.asn1

…

ecrdsa_pub_key.asn1

…

ecrdsa.c

crypto: ecrdsa - Fix module auto-load on add_key

2024-06-16 13:32:34 +02:00

essiv.c

crypto: essiv - Check ssize for decryption and in-place encryption

2025-10-29 14:01:10 +01:00

fcrypt.c

…

fips.c

…

gcm.c

…

geniv.c

…

gf128mul.c

…

ghash-generic.c

…

hash_info.c

…

hmac.c

…

internal.h

…

jitterentropy-kcapi.c

…

jitterentropy.c

crypto: jitter - consider 32 LSB for APT

2022-01-27 10:54:12 +01:00

jitterentropy.h

…

Kconfig

crypto: memneq - move into lib/

2022-06-22 14:13:18 +02:00

keywrap.c

…

khazad.c

…

kpp.c

…

lrw.c

crypto: lrw - Only add ecb if it is not already there

2025-06-27 11:04:01 +01:00

lz4.c

…

lz4hc.c

…

lzo-rle.c

…

lzo.c

…

Makefile

crypto: memneq - move into lib/

2022-06-22 14:13:18 +02:00

md4.c

…

md5.c

…

michael_mic.c

…

nhpoly1305.c

…

ofb.c

…

pcbc.c

…

pcrypt.c

crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY

2024-12-14 19:47:45 +01:00

poly1305_generic.c

…

proc.c

…

ripemd.h

…

rmd128.c

…

rmd160.c

…

rmd256.c

…

rmd320.c

…

rng.c

crypto: rng - Ensure set_ent is always present

2025-10-29 14:01:03 +01:00

rsa_helper.c

…

rsa-pkcs1pad.c

crypto: rsa-pkcs1pad - Use akcipher_request_complete

2023-03-11 16:39:27 +01:00

rsa.c

…

rsaprivkey.asn1

…

rsapubkey.asn1

…

salsa20_generic.c

…

scatterwalk.c

…

scompress.c

crypto: scomp - fix req->dst buffer overflow

2024-01-25 14:37:43 -08:00

seed.c

…

seqiv.c

crypto: seqiv - Do not use req->iv after crypto_aead_encrypt

2026-01-19 13:11:53 +01:00

serpent_generic.c

…

sha1_generic.c

…

sha3_generic.c

…

sha256_generic.c

…

sha512_generic.c

…

shash.c

crypto: shash - avoid comparing pointers to exported functions under CFI

2021-07-14 16:55:54 +02:00

simd.c

…

skcipher.c

…

sm2.c

crypto: sm2 - fix a memory leak in sm2

2021-07-14 16:56:06 +02:00

sm2signature.asn1

…

sm3_generic.c

…

sm4_generic.c

…

streebog_generic.c

…

tcrypt.c

crypto: tcrypt - Fix multibuffer skcipher speed test mem leak

2023-01-14 10:15:50 +01:00

tcrypt.h

…

tea.c

…

testmgr.c

…

testmgr.h

crypto: testmgr - some more fixes to RSA test vectors

2025-03-13 12:47:26 +01:00

tgr192.c

…

twofish_common.c

…

twofish_generic.c

…

vmac.c

…

wp512.c

…

xcbc.c

…

xor.c

…

xts.c

crypto: xts - Only add ecb if it is not already there

2025-06-27 11:04:01 +01:00

xxhash_generic.c

…

zstd.c

…