• David Howells's avatar
    Keys: Fix key serial number collision handling (CVE-2007-0006) · a0cd22f8
    David Howells authored
    Fix the key serial number collision avoidance code in key_alloc_serial().
    
    This didn't use to be so much of a problem as the key serial numbers were
    allocated from a simple incremental counter, and it would have to go through
    two billion keys before it could possibly encounter a collision.  However, n
    that random numbers are used instead, collisions are much more likely.
    
    This is fixed by finding a hole in the rbtree where the next unused serial
    number ought to be and using that by going almost back to the top of the
    insertion routine and redoing the insertion with the new serial number rathe
    than trying to be clever and attempting to work out the insertion point
    pointer directly.
    
    This fixes kernel Bugzilla #7727.
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
    a0cd22f8
key.c 23.6 KB