Описание
In the Linux kernel, the following vulnerability has been resolved:
crypto: s390/aes - Fix buffer overread in CTR mode
When processing the last block, the s390 ctr code will always read
a whole block, even if there isn't a whole block of data left. Fix
this by using the actual length left and copy it into a buffer first
for processing.
A flaw was found in the Linux kernel's s390 Advanced Encryption Standard (AES) cipher implementation. When processing data in Counter (CTR) mode, the driver always reads a full block during the final block operation, even if fewer bytes remain. A local user could exploit this buffer over-read flaw to trigger an out-of-bounds read, causing a system crash and Denial of Service (DoS) or potentially leaking uninitialized memory.
Отчет
This vulnerability is assessed with a Low severity impact because it requires local system access and is strictly limited to IBM Z (s390x) architectures running hardware-accelerated AES in CTR mode. Standard enterprise deployments on other architectures, such as x86_64 or aarch64, do not compile or execute this architecture-specific driver and remain unaffected. On vulnerable s390x installations, the consequence is primarily limited to a denial of service via a kernel crash or potential leakage of uninitialized kernel memory.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2024:4211 | 02.07.2024 |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.
In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.
In the Linux kernel, the following vulnerability has been resolved: c ...
In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.
Уязвимость компонента crypto ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
5.5 Medium
CVSS3