PT-2022-7665 · Linux+3 · Linux Kernel+3
Brian Masney
·
Published
2022-03-14
·
Updated
2025-02-14
·
CVE-2022-48629
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the crypto component of the Linux kernel, specifically the qcom-rng module. The generate function in struct rng alg expects the destination buffer to be completely filled if the function returns 0. However, qcom rng read() can run into a situation where the buffer is partially filled with randomness and the remaining part of the buffer is zeroed since qcom rng generate() doesn't check the return value. This can be reproduced by running the command
kcapi-rng -b 9000000 > OUTFILE from libkcapi, resulting in a file with three huge sections containing all zeros. The issue is caused by the code where the test val & PRNG STATUS DATA AVAIL fails. To fix this, qcom rng read() should always return with a full buffer if the function returns success, and qcom rng generate() should return the correct value.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse