Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Cap AEAD AD length to 0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated data length to 0x80000000.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 400c40cf78da00c16e561a3a253ca272455c42ef before f8a5203596797f394ff3f9aa4005597a92249802; affected 400c40cf78da00c16e561a3a253ca272455c42ef before a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d; affected 400c40cf78da00c16e561a3a253ca272455c42ef before a4fe4eb580bbc7439f649a496d4cf38415a4021c; affected 400c40cf78da00c16e561a3a253ca272455c42ef before e4c4a5074532eaaa14951994a3aad0d479aa7431; affected 400c40cf78da00c16e561a3a253ca272455c42ef before 265ac26d1c5e17b34d497cbda1f754a1ec8552bc; affected 400c40cf78da00c16e561a3a253ca272455c42ef before a1c5672faf8e93e38c2deac3979cc767ca5cf918; affected 400c40cf78da00c16e561a3a253ca272455c42ef before 97948906dc8e0ea84775e03e35b60a2063c70193; affected 400c40cf78da00c16e561a3a253ca272455c42ef before 0b3a57d218618cb1cc78ddc9ba02c07de84b46f4; affected 400c40cf78da00c16e561a3a253ca272455c42ef before e4c06479d7059888adf2f22bc1ebcf053bf691a2 |
| Linux / Linux | affected 4.1; unaffected 0 before 4.1; unaffected 5.10.258 through 5.10.*; unaffected 5.15.209 through 5.15.*; unaffected 6.1.175 through 6.1.*; unaffected 6.6.141 through 6.6.*; unaffected 6.12.91 through 6.12.*; unaffected 6.18.33 through 6.18.*; unaffected 7.0.10 through 7.0.*; unaffected 7.1.5 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/f8a5203596797f394ff3f9aa4005597a92249802
- https://git.kernel.org/stable/c/a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d
- https://git.kernel.org/stable/c/a4fe4eb580bbc7439f649a496d4cf38415a4021c
- https://git.kernel.org/stable/c/e4c4a5074532eaaa14951994a3aad0d479aa7431
- https://git.kernel.org/stable/c/265ac26d1c5e17b34d497cbda1f754a1ec8552bc
- https://git.kernel.org/stable/c/a1c5672faf8e93e38c2deac3979cc767ca5cf918
- https://git.kernel.org/stable/c/97948906dc8e0ea84775e03e35b60a2063c70193
- https://git.kernel.org/stable/c/0b3a57d218618cb1cc78ddc9ba02c07de84b46f4
- https://git.kernel.org/stable/c/e4c06479d7059888adf2f22bc1ebcf053bf691a2
ADP enrichment
A flaw was found in the Linux kernel's `af_alg` cryptography module. This vulnerability involves an arithmetic overflow when processing associated data lengths during the transmit buffer size check. A remote attacker could exploit this flaw by providing a specially crafted associated data length, potentially leading to a denial of service (DoS) due to system instability.