Bug 1214988 - kernel: incorrect accounting when writing to the entropy pool data can lead to overstimating the amount of entropy in the pool weakening the RNG
Summary: kernel: incorrect accounting when writing to the entropy pool data can lead t...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1110044 1211288 1217673 1217674 1217675 1217676 1217677
Blocks: 1163900
TreeView+ depends on / blocked
 
Reported: 2015-04-24 03:49 UTC by Wade Mealing
Modified: 2021-02-17 05:21 UTC (History)
27 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-08-10 05:53:23 UTC
Embargoed:


Attachments (Terms of Use)

Description Wade Mealing 2015-04-24 03:49:49 UTC
Description of the problem:

The upstream kernel mailing list has identified a bug in handling entropy for the kernel  random number generator. When writing entropy to a partially filled pool, some of the  previous entropy will be overwritten.  This would cause the kernel to overestimate available entropy in the pool.

This issue would primarily affect applications using /dev/random since it would depend on true entropy provided by the kernel.

Additional resources:

https://lkml.org/lkml/2013/4/24/5

Comment 4 Wade Mealing 2015-05-01 01:48:40 UTC
Statement:

This issue affects Red Hat Enterprise Linux 5, 6, 7 and MRG-2 kernels.  Future updates may address this issue in the respective Red Hat Enterprise Linux releases.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 7 Wade Mealing 2015-05-05 05:10:51 UTC
Closing this bug up,  Mitre believe that this issue is not a weakness at this point in time as the data provided does not show an accurate ability to provide weakness to processes or kernel utilities that would use this data.


Note You need to log in before you can comment on or make changes to this bug.