pkcs7_check_authattrs() only looks at the first SignerInfo when deciding
whether rejection of authenticated attributes may be waived.  For the
remaining signers it checks only that authenticated attributes are either
present on all signers or absent from all of them.

This means an unmatched ML-DSA signer can be placed first, followed by a
trusted RSA, ECDSA, or ECRDSA signer.  Verification skips the unmatched
signature and accepts the later trusted signer.  The first signer still
leaves the waiver enabled for the whole message, so the non-ML-DSA signer
can use an exception intended only for ML-DSA.

Check each SignerInfo's public-key algorithm before leaving the waiver
enabled.

Fixes: 91db696adea4 ("pkcs7: Allow authenticatedAttributes for ML-DSA")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 crypto/asymmetric_keys/pkcs7_parser.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
index 6e3ffda..7f00e45 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.c
+++ b/crypto/asymmetric_keys/pkcs7_parser.c
@@ -111,6 +111,12 @@ static int pkcs7_check_authattrs(struct pkcs7_message *msg)
 		if (!!sinfo->authattrs != want)
 			goto inconsistent;
 
+#ifdef CONFIG_PKCS7_WAIVE_AUTHATTRS_REJECTION_FOR_MLDSA
+		if (sinfo->authattrs &&
+		    strncmp(sinfo->sig->pkey_algo, "mldsa", 5) != 0)
+			msg->authattrs_rej_waivable = false;
+#endif
+
 		if (!sinfo->authattrs &&
 		    sinfo->sig->algo_takes_data)
 			sinfo->sig->hash_algo = "none";
-- 
2.47.3

On Sat, Aug 22, 2026 at 09:27:04PM +0000, Jérémy Jean wrote:
> pkcs7_check_authattrs() only looks at the first SignerInfo when deciding
> whether rejection of authenticated attributes may be waived.  For the
> remaining signers it checks only that authenticated attributes are either
> present on all signers or absent from all of them.
> 
> This means an unmatched ML-DSA signer can be placed first, followed by a
> trusted RSA, ECDSA, or ECRDSA signer.  Verification skips the unmatched
> signature and accepts the later trusted signer.  The first signer still
> leaves the waiver enabled for the whole message, so the non-ML-DSA signer
> can use an exception intended only for ML-DSA.
> 
> Check each SignerInfo's public-key algorithm before leaving the waiver
> enabled.
> 
> Fixes: 91db696adea4 ("pkcs7: Allow authenticatedAttributes for ML-DSA")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>  crypto/asymmetric_keys/pkcs7_parser.c | 6 ++++++
>  1 file changed, 6 insertions(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt