cve-2024-43815
Vulnerability from cvelistv5
Published
2024-08-17 09:21
Modified
2024-12-19 09:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - Ensure payload is zero when using key slot We could leak stack memory through the payload field when running AES with a key from one of the hardware's key slots. Fix this by ensuring the payload field is set to 0 in such cases. This does not affect the common use case when the key is supplied from main memory via the descriptor payload.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd52b5eeb0f70893f762da7254e923fd23fd1379Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e1640fed0377bf7276efb70d03cb821a6931063dPatch
Impacted products
Vendor Product Version
Linux Linux Version: 3d16af0b4cfac4b2c3b238e2ec37b38c2f316978
Version: 3d16af0b4cfac4b2c3b238e2ec37b38c2f316978
 Create a notification for this product.
   Linux Linux Version: 6.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43815",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:19.469117Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:25.555Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/mxs-dcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e1640fed0377bf7276efb70d03cb821a6931063d",
              "status": "affected",
              "version": "3d16af0b4cfac4b2c3b238e2ec37b38c2f316978",
              "versionType": "git"
            },
            {
              "lessThan": "dd52b5eeb0f70893f762da7254e923fd23fd1379",
              "status": "affected",
              "version": "3d16af0b4cfac4b2c3b238e2ec37b38c2f316978",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/mxs-dcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: mxs-dcp - Ensure payload is zero when using key slot\n\nWe could leak stack memory through the payload field when running\nAES with a key from one of the hardware\u0027s key slots. Fix this by\nensuring the payload field is set to 0 in such cases.\n\nThis does not affect the common use case when the key is supplied\nfrom main memory via the descriptor payload."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:16:23.921Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e1640fed0377bf7276efb70d03cb821a6931063d"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd52b5eeb0f70893f762da7254e923fd23fd1379"
        }
      ],
      "title": "crypto: mxs-dcp - Ensure payload is zero when using key slot",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43815",
    "datePublished": "2024-08-17T09:21:38.065Z",
    "dateReserved": "2024-08-17T09:11:59.270Z",
    "dateUpdated": "2024-12-19T09:16:23.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43815\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T10:15:07.870\",\"lastModified\":\"2025-02-03T15:31:57.177\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: mxs-dcp - Ensure payload is zero when using key slot\\n\\nWe could leak stack memory through the payload field when running\\nAES with a key from one of the hardware\u0027s key slots. Fix this by\\nensuring the payload field is set to 0 in such cases.\\n\\nThis does not affect the common use case when the key is supplied\\nfrom main memory via the descriptor payload.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: crypto: mxs-dcp: aseg\u00farese de que el payload sea cero cuando se usa la ranura de clave. Podr\u00edamos perder memoria de pila a trav\u00e9s del campo de payload  cuando ejecutamos AES con una clave de una de las ranuras de clave del hardware. Solucione este problema asegur\u00e1ndose de que el campo de payload est\u00e9 establecido en 0 en tales casos. Esto no afecta el caso de uso com\u00fan cuando la clave se suministra desde la memoria principal a trav\u00e9s de el payload del descriptor.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"21DC7A88-E88C-4C44-9AFB-CBB30134097C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/dd52b5eeb0f70893f762da7254e923fd23fd1379\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1640fed0377bf7276efb70d03cb821a6931063d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43815\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:09:19.469117Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.314Z\"}}], \"cna\": {\"title\": \"crypto: mxs-dcp - Ensure payload is zero when using key slot\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3d16af0b4cfac4b2c3b238e2ec37b38c2f316978\", \"lessThan\": \"e1640fed0377bf7276efb70d03cb821a6931063d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3d16af0b4cfac4b2c3b238e2ec37b38c2f316978\", \"lessThan\": \"dd52b5eeb0f70893f762da7254e923fd23fd1379\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/crypto/mxs-dcp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/crypto/mxs-dcp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e1640fed0377bf7276efb70d03cb821a6931063d\"}, {\"url\": \"https://git.kernel.org/stable/c/dd52b5eeb0f70893f762da7254e923fd23fd1379\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: mxs-dcp - Ensure payload is zero when using key slot\\n\\nWe could leak stack memory through the payload field when running\\nAES with a key from one of the hardware\u0027s key slots. Fix this by\\nensuring the payload field is set to 0 in such cases.\\n\\nThis does not affect the common use case when the key is supplied\\nfrom main memory via the descriptor payload.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:16:23.921Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43815\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:16:23.921Z\", \"dateReserved\": \"2024-08-17T09:11:59.270Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:21:38.065Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.