The digest comparison in rsassa_pkcs1_verify() uses memcmp(), whose
execution time depends on the position of the first mismatched byte.
This creates a timing side-channel that could allow an attacker to
forge RSA PKCS#1 v1.5 signatures byte by byte.

Notably, the same function already uses crypto_memneq() for the hash
prefix comparison (line 287), making the memcmp() at line 294 an
inconsistent oversight.

Replace memcmp() with crypto_memneq() to perform a constant-time
comparison, consistent with the rest of the function and the crypto
subsystem (gcm, ccm, chacha20poly1305, krb5enc, etc.).

Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
 crypto/rsassa-pkcs1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/rsassa-pkcs1.c b/crypto/rsassa-pkcs1.c
index 94fa5e9600e7..a612a9eef2dd 100644
--- a/crypto/rsassa-pkcs1.c
+++ b/crypto/rsassa-pkcs1.c
@@ -291,7 +291,7 @@ static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
 	/* RFC 8017 sec 8.2.2 step 4 - comparison of digest with out_buf */
 	if (dlen != dst_len - pos)
 		return -EKEYREJECTED;
-	if (memcmp(digest, out_buf + pos, dlen) != 0)
+	if (crypto_memneq(digest, out_buf + pos, dlen))
 		return -EKEYREJECTED;
 
 	return 0;
-- 
2.25.1

On Mon, Jul 20, 2026 at 10:13:22AM +0800, Jiangshan Yi wrote:
> +++ b/crypto/rsassa-pkcs1.c
> @@ -291,7 +291,7 @@ static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
>  	/* RFC 8017 sec 8.2.2 step 4 - comparison of digest with out_buf */
>  	if (dlen != dst_len - pos)
>  		return -EKEYREJECTED;
> -	if (memcmp(digest, out_buf + pos, dlen) != 0)
> +	if (crypto_memneq(digest, out_buf + pos, dlen))
>  		return -EKEYREJECTED;
>  
>  	return 0;

The exact same patch was previously submitted by someone else
and rejected:

https://lore.kernel.org/all/alEr_e-G0L2nxxv-@fudgebox/T/#u