Описание
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
When page reassignment was added to af_alg_pull_tsgl the original
loop wasn't updated so it may try to reassign one more page than
necessary.
Add the check to the reassignment so that this does not happen.
Also update the comment which still refers to the obsolete offset
argument.
A flaw was found in the Linux kernel. Specifically, within the crypto: af_alg component, a page reassignment overflow could occur in the af_alg_pull_tsgl function. This vulnerability arises because the original loop was not updated, potentially allowing it to reassign one more page than necessary. This could lead to unexpected system behavior or a denial of service (DoS).
Отчет
af_alg_pull_tsgl can reassign one extra page into the destination scatterlist because the reassignment path did not check whether plen is non zero. A local process using AF_ALG crypto sockets can craft buffer and scatterlist state so the function advances the destination index for a zero length fragment, which can overrun the caller allocated dst SG entries. For the CVSS the PR:L is used because triggering requires local code execution through the AF_ALG socket API, but not administrator privileges in typical configurations. The issue is not network reachable because the vulnerable input is a local crypto socket operation. Impact is at least local denial of service via kernel crash. In the paranoid case, the destination scatterlist overwrite is treated as a plausible memory corruption primitive with possible confidentiality and integrity impact.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Will not fix | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected |
Показывать по
Дополнительная информация
Статус:
7.3 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more page than necessary. Add the check to the reassignment so that this does not happen. Also update the comment which still refers to the obsolete offset argument.
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more page than necessary. Add the check to the reassignment so that this does not happen. Also update the comment which still refers to the obsolete offset argument.
In the Linux kernel, the following vulnerability has been resolved: c ...
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more page than necessary. Add the check to the reassignment so that this does not happen. Also update the comment which still refers to the obsolete offset argument.
ELSA-2026-50262: Unbreakable Enterprise kernel security update (IMPORTANT)
7.3 High
CVSS3