diff options
| author | David Gstir <david@sigma-star.at> | 2015-11-15 19:14:42 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-02-20 01:28:22 +0300 |
| commit | 1f8b52002e010be989eb2e02bd0c90b65bdb3683 (patch) | |
| tree | 198a9a287c51f7b4453edd18ad60b66aac6a5ac4 | |
| parent | 9af08bfec330b387f7432aacfa2c189e5c3e8d1d (diff) | |
| download | linux-1f8b52002e010be989eb2e02bd0c90b65bdb3683.tar.xz | |
crypto: talitos - Fix timing leak in ESP ICV verification
commit 79960943fdc114fd4583c9ab164b5c89da7aa601 upstream.
Using non-constant time memcmp() makes the verification of the authentication
tag in the decrypt path vulnerable to timing attacks. Fix this by using
crypto_memneq() instead.
Signed-off-by: David Gstir <david@sigma-star.at>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/crypto/talitos.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c index 3b20a1bce703..8b327d89a8fc 100644 --- a/drivers/crypto/talitos.c +++ b/drivers/crypto/talitos.c @@ -1015,7 +1015,7 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev, } else oicv = (char *)&edesc->link_tbl[0]; - err = memcmp(oicv, icv, authsize) ? -EBADMSG : 0; + err = crypto_memneq(oicv, icv, authsize) ? -EBADMSG : 0; } kfree(edesc); |