Bug 1708775 (CVE-2020-10769) - CVE-2020-10769 kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not aligned.
Summary: CVE-2020-10769 kernel: Buffer over-read in crypto_authenc_extractkeys() when ...
Keywords:
Status: NEW
Alias: CVE-2020-10769
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1846104 1846105 1846355
Blocks: 1708776
TreeView+ depends on / blocked
 
Reported: 2019-05-10 20:15 UTC by Pedro Sampaio
Modified: 2020-06-26 04:44 UTC (History)
50 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A buffer over-read flaw was found in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Pedro Sampaio 2019-05-10 20:15:18 UTC
A buffer overread problem was found in crypto_authenc_extractkeys in crypto/authenc.c in IPsec Cryptographic algorithms module authenc. When a payload longer than 4 bytes, is not following a 4-byte alignment boundary guidelines, may cause a buffer overread threat, leading to a system crash problem. An attacker locally with a user privilege can cause a denial of service (DoS).  

crypto_authenc_extractkeys() fails to consider the case where the rtattr's payload is longer than 4 bytes but not 4-byte aligned, and where the key ends before the next 4-byte aligned boundary.  In this case, 'keylen -=RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX.  This causes a buffer overread and crash during  crypto_ahash_setkey().

Proposed upstrem patch:

https://lkml.org/lkml/2019/1/21/675

Comment 4 Rohit Keshri 2020-06-10 18:48:32 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.


Note You need to log in before you can comment on or make changes to this bug.