Описание
In the Linux kernel, the following vulnerability has been resolved:
s390/crypto: Fix skcipher_walk return code handling in aes_s390
The return codes from skcipher_walk_virt() were not properly checked
before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt().
If skcipher_walk_virt() fails, the walk structure may be in an undefined
state, and attempting to process data could lead to incorrect behavior
or accessing uninitialized memory.
Add proper return code checking to ensure correct handling of the walk
initialization and walk advance and eventually return to the caller
with that return code.
A flaw was found in the Linux kernel's s390 cryptographic subsystem. Missing error code verification during AES (Advanced Encryption Standard) cipher operations allows data processing loops to execute even if setup fails. A local user could exploit this vulnerability during cryptographic operations to cause the system to access uninitialized memory, leading to a Denial of Service (DoS) via a kernel crash or potential information disclosure.
Отчет
A low impact flaw was found in the Linux kernel's s390 cryptographic subsystem, in the AES skcipher implementation (aes_s390) used by Red Hat Enterprise Linux and other Red Hat products that ship affected kernels. The return codes from skcipher_walk_virt() were not properly checked before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If the walk initialization fails, the walk structure may be in an undefined state, and continuing to process data with it can access uninitialized memory, leading to a kernel crash and local denial of service, with potential information disclosure. A local user with low privileges could trigger this issue by submitting cryptographic requests that exercise the affected s390 AES code paths and cause the walk setup to fail. Red Hat Enterprise Linux 7 and 8 (including kernel-rt and OpenShift releases built on RHEL 8 CoreOS) are not affected because the vulnerable code is not present in those kernels, and RHEL 6 ELS is out of support scope. For the affected streams (Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform releases based on RHEL 9 CoreOS), the fix is deferred because this is a low-severity error-handling issue that requires an uncommon failure during cryptographic walk setup to trigger; the residual risk is primarily local denial of service on s390x (IBM Z) systems. Although the Red Hat CVSS 3.1 base score is 5.5 (Moderate) with high availability impact, the flaw is rated low impact overall because exploitation requires a local actor, the failing path is difficult to reach reliably, and no controlled information disclosure or privilege escalation primitive is established.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipher_walk return code handling in aes_s390 The return codes from skcipher_walk_virt() were not properly checked before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, and attempting to process data could lead to incorrect behavior or accessing uninitialized memory. Add proper return code checking to ensure correct handling of the walk initialization and walk advance and eventually return to the caller with that return code.
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipher_walk return code handling in aes_s390 The return codes from skcipher_walk_virt() were not properly checked before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, and attempting to process data could lead to incorrect behavior or accessing uninitialized memory. Add proper return code checking to ensure correct handling of the walk initialization and walk advance and eventually return to the caller with that return code.
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipher_walk return code handling in aes_s390 The return codes from skcipher_walk_virt() were not properly checked before entering the processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, and attempting to process data could lead to incorrect behavior or accessing uninitialized memory. Add proper return code checking to ensure correct handling of the walk initialization and walk advance and eventually return to the caller with that return code.
EPSS
5.5 Medium
CVSS3