Action disabled: source

X.509: Fix self-signed determination

This change “X.509: Fix self-signed determination” (commit ad3043f) in Linux kernel is authored by David Howells <dhowells [at] redhat.com> on Wed Apr 6 16:13:34 2016 +0100.

Description of "X.509: Fix self-signed determination"

The change “X.509: Fix self-signed determination” introduces changes as follows.

X.509: Fix self-signed determination

There's a bug in the code determining whether a certificate is self-signed
or not: if they have neither AKID nor SKID then we just assume that the
cert is self-signed, which may not be true.

Fix this by checking that the raw subject name matches the raw issuer name
and that the public key algorithm for the key and signature are both the
same in addition to requiring that the AKID bits match.

Signed-off-by: David Howells <dhowells@redhat.com>

Linux kernel releases containing commit ad3043f

The Linux kernel releases containing this commit are as follows.

Linux kernel code changes from "X.509: Fix self-signed determination"

There are 9 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 crypto/asymmetric_keys/x509_public_key.c | 9 +++++++++
 1 file changed, 9 insertions(+)
 
diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 752d8d5b48fa..fc77a2bd70ba 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -230,6 +230,11 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
 
 	pr_devel("==>%s()\n", __func__);
 
+	if (cert->raw_subject_size != cert->raw_issuer_size ||
+	    memcmp(cert->raw_subject, cert->raw_issuer,
+		   cert->raw_issuer_size) != 0)
+		goto not_self_signed;
+
 	if (cert->sig->auth_ids[0] || cert->sig->auth_ids[1]) {
 		/* If the AKID is present it may have one or two parts.  If
 		 * both are supplied, both must match.
@@ -246,6 +251,10 @@ int x509_check_for_self_signed(struct x509_certificate *cert)
 			goto out;
 	}
 
+	ret = -EKEYREJECTED;
+	if (cert->pub->pkey_algo != cert->sig->pkey_algo)
+		goto out;
+
 	ret = public_key_verify_signature(cert->pub, cert->sig);
 	if (ret < 0) {
 		if (ret == -ENOPKG) {

The commit for this change in Linux stable tree is ad3043f (patch).

Last modified: 2020/02/09