The ASN.1 GeneralizedTime object carries an ISO8601 format date and time.
The time is permitted to show midnight as 00:00 or 24:00 (the latter being
equivalent of 00:00 of the following day).
The permitted value is checked in x509_decode_time() but the actual
handling is left to mktime64().
Without this patch, certain X.509 certificates will be rejected and could
lead to an unbootable kernel.
Reported-by: Rudolf Polzer <rpolzer@xxxxxxxxxx>
Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
cc: David Woodhouse <David.Woodhouse@xxxxxxxxx>
cc: John Stultz <john.stultz@xxxxxxxxxx>
cc: Arnd Bergmann <arnd@xxxxxxxx>
cc: stable@xxxxxxxxxxxxxxx
---
crypto/asymmetric_keys/x509_cert_parser.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 9be2caebc57b..b9de251c419c 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -497,7 +497,7 @@ int x509_decode_time(time64_t *_t, size_t hdrlen,
static const unsigned char month_lengths[] = { 31, 28, 31, 30, 31, 30,
31, 31, 30, 31, 30, 31 };
const unsigned char *p = value;
- unsigned year, mon, day, hour, min, sec, mon_len, max_sec;
+ unsigned year, mon, day, hour, min, sec, mon_len, max_sec, max_hour;
#define dec2bin(X) ({ unsigned char x = (X) - '0'; if (x > 9) goto invalid_time; x; })
#define DD2bin(P) ({ unsigned x = dec2bin(P[0]) * 10 + dec2bin(P[1]); P += 2; x; })
@@ -512,6 +512,7 @@ int x509_decode_time(time64_t *_t, size_t hdrlen,
else
year += 2000;
max_sec = 59;
+ max_hour = 23;
} else if (tag == ASN1_GENTIM) {
/* GenTime: YYYYMMDDHHMMSSZ */
if (vlen != 15)
@@ -520,6 +521,7 @@ int x509_decode_time(time64_t *_t, size_t hdrlen,
if (year >= 1950 && year <= 2049)
goto invalid_time;
max_sec = 60; /* ISO 8601 permits leap seconds [X.680 46.3] */
+ max_hour = 24;
} else {
goto unsupported_time;
}
@@ -550,11 +552,17 @@ int x509_decode_time(time64_t *_t, size_t hdrlen,
}
if (day < 1 || day > mon_len ||
- hour > 23 ||
+ hour > max_hour ||
min > 59 ||
sec > max_sec)
goto invalid_time;
+ /* GeneralizedTime, encoded as ISO 8601, also permits 24:00 today as an
+ * alternative for 00:00 tomorrow.
+ */
+ if (hour == 24 && (min != 0 || sec != 0))
+ goto invalid_time;
+
*_t = mktime64(year, mon, day, hour, min, sec);
return 0;
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html