[PATCH] crypto: pkcs7_verify: use constant-time comparison for digest and signature verification

[David C.C.M. Gall]

Replace memcmp() with crypto_memneq() for cryptographic digest and
signature comparisons to prevent timing side-channel attacks.

crypto/asymmetric_keys/pkcs7_verify.c: PKCS#7 message digest comparison
during signature verification passes argument pkcs7 and attached
signatures to pkcs7_digest via pkcs7_verify_one. pkcs7_digest utilized
memcmp which could leak valid prefix length for attached signatures via
timing side-channel.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@xxxxxxxxxxxxxx>
---
 crypto/asymmetric_keys/pkcs7_verify.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 474e2c1ae21b..28953e53177b 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -13,6 +13,7 @@
 #include <linux/asn1.h>
 #include <crypto/hash.h>
 #include <crypto/hash_info.h>
+#include <crypto/utils.h>
 #include <crypto/public_key.h>
 #include "pkcs7_parser.h"
 
@@ -93,8 +94,8 @@ static int pkcs7_digest(struct pkcs7_message *pkcs7,
 			goto error;
 		}
 
-		if (memcmp(sig->m, sinfo->msgdigest,
-			   sinfo->msgdigest_len) != 0) {
+		if (crypto_memneq(sig->m, sinfo->msgdigest,
+				  sinfo->msgdigest_len)) {
 			pr_warn("Sig %u: Message digest doesn't match\n",
 				sinfo->index);
 			ret = -EKEYREJECTED;
-- 
2.43.0