path: root/certs
diff options
authorMickaël Salaün <>2020-11-20 19:04:18 +0100
committerDavid Howells <>2021-01-21 16:16:10 +0000
commit84ffbefd657b25dbca0dbd7772226fb83b8213b8 (patch)
tree54bf19b1cc612325fad5fb6f43e803d92f934022 /certs
parent0b2d443bf52756a9c364a41492dae537bc62683f (diff)
certs: Fix blacklisted hexadecimal hash string check
When looking for a blacklisted hash, bin2hex() is used to transform a binary hash to an ascii (lowercase) hexadecimal string. This string is then search for in the description of the keys from the blacklist keyring. When adding a key to the blacklist keyring, blacklist_vet_description() checks the hash prefix and the hexadecimal string, but not that this string is lowercase. It is then valid to set hashes with uppercase hexadecimal, which will be silently ignored by the kernel. Add an additional check to blacklist_vet_description() to check that hexadecimal strings are in lowercase. Signed-off-by: Mickaël Salaün <> Signed-off-by: David Howells <> Reviewed-by: Ben Boeckel <> Cc: David Woodhouse <>
Diffstat (limited to 'certs')
1 files changed, 1 insertions, 1 deletions
diff --git a/certs/blacklist.c b/certs/blacklist.c
index 2719fb2fbc1c..a888b934a1cd 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -37,7 +37,7 @@ static int blacklist_vet_description(const char *desc)
for (; *desc; desc++) {
- if (!isxdigit(*desc))
+ if (!isxdigit(*desc) || isupper(*desc))
return -EINVAL;