PT-2024-10447 · Linux+6 · Linux Kernel+6
Published
2024-07-29
·
Updated
2026-03-14
·
CVE-2024-42098
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the crypto component of the Linux kernel, specifically with the ecdh (Elliptic Curve Diffie-Hellman) key exchange. The problem arises when the caller provides a key or a newly generated key that is shorter than the previous key, potentially leaving some key material from the previous key not overwritten. The solution is to explicitly zeroize the entire private key array first. This patch changes the behavior of the function, ensuring that the private key is always zeroized, even if the ecc gen privkey fails or if params.key is set and ecc is key valid fails.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu