KEYS: encrypted: fix integer overflow of datablob_len
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.112, 6.18.54, 7.2.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16_MAX, the assignment truncates the allocation size. KASAN reports a 32760-byte slab-out-of-bounds write when __ekey_init() copies the master key description into the undersized buffer. The total payload length stored in key->datalen is also a u16. Use check_add_overflow() to reject values that do not fit either destination, and use kzalloc_flex() for the flexible-array allocation.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 7e70cb4978507cf31d76b90e4cfb4c28cad87f0c · fixed in 1e720f63dbafc093a8f5d519f05b67724993edd4; From 7e70cb4978507cf31d76b90e4cfb4c28cad87f0c · fixed in a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0; From 7e70cb4978507cf31d76b90e4cfb4c28cad87f0c · fixed in cca38f2102a4cd35eda8d48950df4817b4b24757; From 7e70cb4978507cf31d76b90e4cfb4c28cad87f0c · fixed in 8697c431e297eb0d0ab13dda6bc172b48a34f05c
- Linux Linux
2.6.38
- KernelLinux
From 2.6.38 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.54; From 6.19.0 · fixed in 7.2.8