Bug 2301546 (CVE-2024-42229) - CVE-2024-42229 kernel: crypto: aead,cipher - zeroize key buffer after use
Summary: CVE-2024-42229 kernel: crypto: aead,cipher - zeroize key buffer after use
Keywords:
Status: NEW
Alias: CVE-2024-42229
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2303714
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-30 09:10 UTC by OSIDB Bzimport
Modified: 2024-09-24 12:29 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2024-07-30 09:10:24 UTC 
In the Linux kernel, the following vulnerability has been resolved:

crypto: aead,cipher - zeroize key buffer after use

I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding
cryptographic information should be zeroized once they are no longer
needed. Accomplish this by using kfree_sensitive for buffers that
previously held the private key.
Note You need to log in before you can comment on or make changes to this bug.