Description
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Linux / Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 – 893d22e0135fa394db81df88697fba6032747667
- Linux / Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 – 19d43105a97be0810edbda875f2cd03f30dc130c
- Linux / Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 – 961cfa271a918ad4ae452420e7c303149002875b
- Linux / Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 – 3115af9644c342b356f3f07a4dd1c8905cd9a6fc
- Linux / Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 – 8b88d99341f139e23bdeb1027a2a3ae10d341d82
- Linux / Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 – fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8
- Linux / Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 – ce42ee423e58dffa5ec03524054c9d8bfd4f6237
- Linux / Linux72548b093ee38a6d4f2a19e6ef1948ae05c181f7 – a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5
- Linux / Linux4.14 – 4.14
- Linux / Linux0 – 4.14
- Linux / Linux5.10.254 – 5.10.*
- Linux / Linux5.15.204 – 5.15.*
- Linux / Linux6.1.170 – 6.1.*
- Linux / Linux6.6.137 – 6.6.*
- Linux / Linux6.12.85 – 6.12.*
- Linux / Linux6.18.22 – 6.18.*
- Linux / Linux6.19.12 – 6.19.*
- Linux / Linux7.0 – *
Exploits & proofs of concept
- nucleiCopy Fail - Linux Kernel Local Privilege Escalation via AF_ALGby ritikchaddha
References
- MISChttps://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667
- MISChttps://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c
- MISChttps://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b
- MISChttps://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc
- MISChttps://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82
- MISChttps://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8
- MISChttps://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237
- MISChttps://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5