CVE-2016-0758: Other (NVD-CWE-Other)
value: Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2016-06-27T10:59Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: lib/asn1_decoder.c
Commit date: 2016-05-12 12:01:49 +0100
Commit message: KEYS: Fix ASN.1 indefinite length object parsing

This fixes CVE-2016-0758.

In the ASN.1 decoder, when the length field of an ASN.1 value is extracted,
it isn't validated against the remaining amount of data before being added
to the cursor.  With a sufficiently large size indicated, the check:

	datalen - dp < 2

may then fail due to integer overflow.

Fix this by checking the length indicated against the amount of remaining
data in both places a definite length is determined.

Whilst we're at it, make the following changes:

 (1) Check the maximum size of extended length does not exceed the capacity
     of the variable it's being stored in (len) rather than the type that
     variable is assumed to be (size_t).

 (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the
     integer 0.

 (3) To reduce confusion, move the initialisation of len outside of:

	for (len = 0; n > 0; n--) {

     since it doesn't have anything to do with the loop counter n.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: David Woodhouse <David.Woodhouse@intel.com>
Acked-by: Peter Jones <pjones@redhat.com>

Diff: diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c
index 2b3f46c049d458..554522934c442a 100644
--- a/lib/asn1_decoder.c
+++ b/lib/asn1_decoder.c
@@ -72,11 +72,11 @@ static int asn1_find_indefinite_length(const unsigned char *data, size_t datalen
 		goto data_overrun_error;
 	}
 
 	/* Extract a tag from the data */
 	tag = data[dp++];
-	if (tag == 0) {
+	if (tag == ASN1_EOC) {
 		/* It appears to be an EOC. */
 		if (data[dp++] != 0)
 			goto invalid_eoc;
 		if (--indef_level <= 0) {
 			*_len = dp - *_dp;
@@ -94,32 +94,34 @@ static int asn1_find_indefinite_length(const unsigned char *data, size_t datalen
 		} while (tmp & 0x80);
 	}
 
 	/* Extract the length */
 	len = data[dp++];
-	if (len <= 0x7f) {
-		dp += len;
-		goto next_tag;
-	}
+	if (len <= 0x7f)
+		goto check_length;
 
 	if (unlikely(len == ASN1_INDEFINITE_LENGTH)) {
 		/* Indefinite length */
 		if (unlikely((tag & ASN1_CONS_BIT) == ASN1_PRIM << 5))
 			goto indefinite_len_primitive;
 		indef_level++;
 		goto next_tag;
 	}
 
 	n = len - 0x80;
-	if (unlikely(n > sizeof(size_t) - 1))
+	if (unlikely(n > sizeof(len) - 1))
 		goto length_too_long;
 	if (unlikely(n > datalen - dp))
 		goto data_overrun_error;
-	for (len = 0; n > 0; n--) {
+	len = 0;
+	for (; n > 0; n--) {
 		len <<= 8;
 		len |= data[dp++];
 	}
+check_length:
+	if (len > datalen - dp)
+		goto data_overrun_error;
 	dp += len;
 	goto next_tag;
 
 length_too_long:
 	*_errmsg = "Unsupported length";

Vulnerable code: 	if (tag == 0) {
	if (len <= 0x7f) {
		dp += len;
		goto next_tag;
	}
	if (unlikely(n > sizeof(size_t) - 1))
	for (len = 0; n > 0; n--) {
Fixed code: 	if (tag == ASN1_EOC) {
	if (len <= 0x7f)
		goto check_length;
	if (unlikely(n > sizeof(len) - 1))
	len = 0;
	for (; n > 0; n--) {
check_length:
	if (len > datalen - dp)
		goto data_overrun_error;