Lukas Wunner 3b626ba431 X.509: Fix validation of ASN.1 certificate header ...

x509_load_certificate_list() seeks to enforce that a certificate starts
with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256
and less than 65535 bytes).

But it only enforces that *either* of those two byte values are present,
instead of checking for the *conjunction* of the two values.  Fix it.

Fixes: 631cc66eb9 ("MODSIGN: Provide module signing public keys to the kernel")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260508033917.B5873C2BCB0@smtp.kernel.org/
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.7+
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

2026-05-22 20:25:29 +08:00

..

asymmetric_keys.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36

2019-05-24 17:27:11 +02:00

asymmetric_type.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Kconfig

keys: cleanup dead code in Kconfig for FIPS_SIGNATURE_SELFTEST

2026-05-05 16:15:24 +08:00

Makefile

certs: Add ECDSA signature verification self-test

2024-05-14 05:01:04 +03:00

mscode_parser.c

Revert "crypto: pkcs7 - remove sha1 support"

2024-03-22 19:42:20 +08:00

mscode.asn1

pefile: Parse the "Microsoft individual code signing" data blob

2014-07-09 14:58:37 +01:00

pkcs7_key_type.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36

2019-05-24 17:27:11 +02:00

pkcs7_parser.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

pkcs7_parser.h

pkcs7: Allow authenticatedAttributes for ML-DSA

2026-02-02 16:58:21 +00:00

pkcs7_trust.c

keys: X.509 public key issuer lookup without AKID

2022-01-09 00:18:42 +02:00

pkcs7_verify.c

pkcs7: Change a pr_warn() to pr_warn_once()

2026-02-05 15:44:00 +00:00

pkcs7.asn1

treewide: Add SPDX identifier to IETF ASN.1 modules

2023-10-27 18:04:28 +08:00

pkcs8_parser.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

pkcs8.asn1

treewide: Add SPDX identifier to IETF ASN.1 modules

2023-10-27 18:04:28 +08:00

public_key.c

pkcs7, x509: Add ML-DSA support

2026-01-30 11:34:34 +00:00

restrict.c

KEYS: Avoid -Wflex-array-member-not-at-end warning

2025-11-22 10:04:50 +08:00

selftest_ecdsa.c

certs: Add ECDSA signature verification self-test

2024-05-14 05:01:04 +03:00

selftest_rsa.c

certs: Move RSA self-test data to separate file

2024-05-14 05:01:03 +03:00

selftest.c

certs: Add ECDSA signature verification self-test

2024-05-14 05:01:04 +03:00

selftest.h

certs: Add ECDSA signature verification self-test

2024-05-14 05:01:04 +03:00

signature.c

pkcs7: Allow the signing algo to do whatever digestion it wants itself

2026-01-30 11:33:19 +00:00

verify_pefile.c

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

2026-05-07 16:10:03 +08:00

verify_pefile.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36

2019-05-24 17:27:11 +02:00

x509_akid.asn1

treewide: Add SPDX identifier to IETF ASN.1 modules

2023-10-27 18:04:28 +08:00

x509_cert_parser.c

X.509: Fix out-of-bounds access when parsing extensions

2026-04-12 13:38:19 +08:00

x509_loader.c

X.509: Fix validation of ASN.1 certificate header

2026-05-22 20:25:29 +08:00

x509_parser.h

x509: Separately calculate sha256 for blacklist

2026-01-30 11:32:23 +00:00

x509_public_key.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

x509.asn1

treewide: Add SPDX identifier to IETF ASN.1 modules

2023-10-27 18:04:28 +08:00