The MIC checksum comparison in rfc3961_verify_mic() uses memcmp(),
whose execution time depends on the position of the first mismatched
byte. This creates a timing side-channel that could allow an attacker
to forge Kerberos checksums byte by byte.

The same crypto/krb5 subsystem already uses crypto_memneq() for the
equivalent checksum comparison in crypto/krb5enc.c (line 255), making
the memcmp() in rfc3961_simplified.c an inconsistent oversight.

Replace memcmp() with crypto_memneq() to perform a constant-time
comparison, consistent with the rest of the crypto subsystem
(gcm, ccm, chacha20poly1305, rsassa-pkcs1, etc.). Add an explicit
<crypto/utils.h> include since this file did not previously pull in
the crypto_memneq() declaration.

Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
 crypto/krb5/rfc3961_simplified.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crypto/krb5/rfc3961_simplified.c b/crypto/krb5/rfc3961_simplified.c
index e49cbdec7c40..8722609bb723 100644
--- a/crypto/krb5/rfc3961_simplified.c
+++ b/crypto/krb5/rfc3961_simplified.c
@@ -75,6 +75,7 @@
 #include <crypto/authenc.h>
 #include <crypto/skcipher.h>
 #include <crypto/hash.h>
+#include <crypto/utils.h>
 #include "internal.h"
 
 /* Maximum blocksize for the supported crypto algorithms */
@@ -763,7 +764,7 @@ int rfc3961_verify_mic(const struct krb5_enctype *krb5,
 	if (done != krb5->cksum_len)
 		goto error;
 
-	if (memcmp(cksum, cksum2, krb5->cksum_len) != 0) {
+	if (crypto_memneq(cksum, cksum2, krb5->cksum_len)) {
 		ret = -EBADMSG;
 		goto error;
 	}
-- 
2.25.1