From: David Marchand <[email protected]>
Incorrect lengths expressed as 32 bit unsigned integers in the crypto
operation request could go unnoticed as those were summed in a too
narrow 32 bit unsigned integer.
This issue was not fixed by the previous fixes (under CVE-2020-14376
and CVE-2020-14378).
CVE-2026-86849
Bugzilla ID: 2022
Fixes: 3bb595ecd682 ("vhost/crypto: add request handler")
Cc: [email protected]
Acked-by: Bruce Richardson <[email protected]>
Signed-off-by: David Marchand <[email protected]>
---
lib/vhost/vhost_crypto.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/vhost/vhost_crypto.c b/lib/vhost/vhost_crypto.c
index 351fa241c8..bba2e1c0a6 100644
--- a/lib/vhost/vhost_crypto.c
+++ b/lib/vhost/vhost_crypto.c
@@ -1182,11 +1182,11 @@ vhost_crypto_check_chain_request(struct
virtio_crypto_alg_chain_data_req *req)
(req->para.hash_start_src_offset <
VHOST_CRYPTO_MAX_DATA_SIZE) &&
(req->para.len_to_hash <= VHOST_CRYPTO_MAX_DATA_SIZE) &&
- (req->para.cipher_start_src_offset + req->para.len_to_cipher <=
+ ((uint64_t)req->para.cipher_start_src_offset +
req->para.len_to_cipher <=
req->para.src_data_len) &&
- (req->para.hash_start_src_offset + req->para.len_to_hash <=
+ ((uint64_t)req->para.hash_start_src_offset +
req->para.len_to_hash <=
req->para.src_data_len) &&
- (req->para.dst_data_len + req->para.hash_result_len <=
+ ((uint64_t)req->para.dst_data_len + req->para.hash_result_len <=
VHOST_CRYPTO_MAX_DATA_SIZE)))
return VIRTIO_CRYPTO_OK;
return VIRTIO_CRYPTO_BADMSG;
--
2.56.0
