PT-2025-8022 · Linux+1 · Linux Kernel+1
Ziyang Xuan
·
Publicado
2022-04-01
·
Atualizado
2025-03-03
·
CVE-2022-49094
CVSS v3.1
7.1
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A slab-out-of-bounds bug has been identified in the Linux kernel, specifically in the
decrypt internal function within the net/tls module. The issue arises from a mismatch in memory size allocation for tls ctx->rx.iv when using AES128-CCM, where tls set sw offload() sets the size to 12, but crypto aead ivsize() returns a size of 16 for "ccm(aes)". This discrepancy triggers a slab-out-of-bounds bug when memcpy() attempts to read 16 bytes from a 12-byte memory space. The bug can be traced to the decrypt internal+0x385/0xc40 function in the tls module.Recommendations
To resolve this issue, replace the
crypto aead ivsize() call with prot->iv size + prot->salt size when copying the IV value in the TLS 1 3 VERSION scenario. This change should be applied to the decrypt internal function to prevent the slab-out-of-bounds bug. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Out of bounds Read
Unchecked Return Value
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Astra Linux
Linux Kernel