A memory leak in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel allows attackers to cause a denial of service (memory consumption).
The patch for this one fixes:
1) If we ccp_init_data() fails for &src then we need to free aad.
Use goto e_aad instead of goto e_ctx.
2) The label to free the &final_wa was named incorrectly as "e_tag" but
it should have been "e_final_wa". One error path leaked &final_wa.
3) The &tag was leaked on one error path. In that case, I added a free
before the goto because the resource was local to that block.
This vulnerability is similar with the older CVE-2019-18808.
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2009413]
the fixing upstream commit is present since v5.15-rc4 and is:
505d9dcb0f7d ("crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()")