[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 13/20] crypto: validate that LUKS payload doesn't overlap with hea
From: |
Daniel P . Berrangé |
Subject: |
[PULL 13/20] crypto: validate that LUKS payload doesn't overlap with header |
Date: |
Thu, 27 Oct 2022 18:30:56 +0100 |
We already validate that LUKS keyslots don't overlap with the
header, or with each other. This closes the remaining hole in
validation of LUKS file regions.
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
crypto/block-luks.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/crypto/block-luks.c b/crypto/block-luks.c
index 6ef9a89ffa..f22bc63e54 100644
--- a/crypto/block-luks.c
+++ b/crypto/block-luks.c
@@ -572,6 +572,13 @@ qcrypto_block_luks_check_header(const QCryptoBlockLUKS
*luks, Error **errp)
return -1;
}
+ if (luks->header.payload_offset_sector <
+ DIV_ROUND_UP(QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET,
+ QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) {
+ error_setg(errp, "LUKS payload is overlapping with the header");
+ return -1;
+ }
+
/* Check all keyslots for corruption */
for (i = 0 ; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS ; i++) {
--
2.37.3
- [PULL 01/20] crypto/luks: Support creating LUKS image on Darwin, (continued)
- [PULL 01/20] crypto/luks: Support creating LUKS image on Darwin, Daniel P . Berrangé, 2022/10/27
- [PULL 05/20] io/channel-watch: Fix socket watch on Windows, Daniel P . Berrangé, 2022/10/27
- [PULL 02/20] util/qemu-sockets: Use g_get_tmp_dir() to get the directory for temporary files, Daniel P . Berrangé, 2022/10/27
- [PULL 09/20] tests: avoid DOS line endings in PSK file, Daniel P . Berrangé, 2022/10/27
- [PULL 10/20] crypto: sanity check that LUKS header strings are NUL-terminated, Daniel P . Berrangé, 2022/10/27
- [PULL 11/20] crypto: enforce that LUKS stripes is always a fixed value, Daniel P . Berrangé, 2022/10/27
- [PULL 14/20] crypto: strengthen the check for key slots overlapping with LUKS header, Daniel P . Berrangé, 2022/10/27
- [PULL 15/20] crypto: check that LUKS PBKDF2 iterations count is non-zero, Daniel P . Berrangé, 2022/10/27
- [PULL 07/20] scripts: check if .git exists before checking submodule status, Daniel P . Berrangé, 2022/10/27
- [PULL 06/20] seccomp: Get actual errno value from failed seccomp functions, Daniel P . Berrangé, 2022/10/27
- [PULL 13/20] crypto: validate that LUKS payload doesn't overlap with header,
Daniel P . Berrangé <=
- [PULL 16/20] crypto: split LUKS header definitions off into file, Daniel P . Berrangé, 2022/10/27
- [PULL 17/20] crypto: split off helpers for converting LUKS header endianess, Daniel P . Berrangé, 2022/10/27
- [PULL 20/20] crypto: add test cases for many malformed LUKS header scenarios, Daniel P . Berrangé, 2022/10/27
- [PULL 12/20] crypto: enforce that key material doesn't overlap with LUKS header, Daniel P . Berrangé, 2022/10/27
- [PULL 19/20] crypto: ensure LUKS tests run with GNUTLS crypto provider, Daniel P . Berrangé, 2022/10/27
- [PULL 18/20] crypto: quote algorithm names in error messages, Daniel P . Berrangé, 2022/10/27
- Re: [PULL 00/20] Crypto and I/O patches, Stefan Hajnoczi, 2022/10/31