Messages in this thread | | | From | Kees Cook <> | Subject | Re: [PATCH] LoadPin: Require file with verity root digests to have a header | Date | Wed, 7 Sep 2022 16:21:45 -0700 |
| |
On Tue, 6 Sep 2022 18:18:12 -0700, Matthias Kaehlcke wrote: > LoadPin expects the file with trusted verity root digests to be > an ASCII file with one digest (hex value) per line. A pinned > root could contain files that meet these format requirements, > even though the hex values don't represent trusted root > digests. > > Add a new requirement to the file format which consists in > the first line containing a fixed string. This prevents > attackers from feeding files with an otherwise valid format > to LoadPin. > > [...]
Applied to for-next/hardening, thanks!
[1/1] LoadPin: Require file with verity root digests to have a header https://git.kernel.org/kees/c/d64f3001976e
-- Kees Cook
| |