From b57151ac0366d3fb14318a55b0fc943134f7f80b Mon Sep 17 00:00:00 2001 From: Daniel P. Berrangé Date: Mon, 5 Sep 2022 13:52:29 +0100 Subject: crypto: check that LUKS PBKDF2 iterations count is non-zero Both the master key and key slot passphrases are run through the PBKDF2 algorithm. The iterations count is expected to be generally very large (many 10's or 100's of 1000s). It is hard to define a low level cutoff, but we can certainly say that iterations count should be non-zero. A zero count likely indicates an initialization mistake so reject it. Reviewed-by: Richard W.M. Jones Signed-off-by: Daniel P. Berrangé --- crypto/block-luks.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/crypto/block-luks.c b/crypto/block-luks.c index e6ee8506b2..254490c256 100644 --- a/crypto/block-luks.c +++ b/crypto/block-luks.c @@ -579,6 +579,11 @@ qcrypto_block_luks_check_header(const QCryptoBlockLUKS *luks, Error **errp) return -1; } + if (luks->header.master_key_iterations == 0) { + error_setg(errp, "LUKS key iteration count is zero"); + return -1; + } + /* Check all keyslots for corruption */ for (i = 0 ; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS ; i++) { @@ -602,6 +607,12 @@ qcrypto_block_luks_check_header(const QCryptoBlockLUKS *luks, Error **errp) return -1; } + if (slot1->active == QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED && + slot1->iterations == 0) { + error_setg(errp, "Keyslot %zu iteration count is zero", i); + return -1; + } + if (start1 < DIV_ROUND_UP(QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) { error_setg(errp, -- cgit v1.2.3-55-g7522