On Sun, 30 Aug 2026 09:40:38 +0200, Heinrich Schuchardt wrote:
> rsa_gen_key_prop() copies the DER public exponent into a fixed 8 byte
> buffer with memcpy(pub_exp + sizeof(uint64_t) - e_sz, e, e_sz). e_sz
> comes from the key and is only bounded by e_sz <= n_sz in rsa_get_e(),
> nothing limits it to 8 bytes. Since e_sz is a size_t, an exponent larger
> than 8 bytes underflows the destination to pub_exp - (e_sz - 8) and
> writes attacker-controlled bytes below the allocation. A 256 byte
> exponent gives a 248 byte heap underflow of controlled content.
>
> [...]
Applied to u-boot/next, thanks!
[1/1] lib: rsa: reject oversized public exponent in rsa_gen_key_prop()
commit: a5c62c87ecb1a0741891eb7d2abfb6429bc62a46
--
Tom
