A buffer overread problem was found in crypto_authenc_extractkeys in crypto/authenc.c in IPsec Cryptographic algorithms module authenc. When a payload longer than 4 bytes, is not following a 4-byte alignment boundary guidelines, may cause a buffer overread threat, leading to a system crash problem. An attacker locally with a user privilege can cause a denial of service (DoS). crypto_authenc_extractkeys() fails to consider the case where the rtattr's payload is longer than 4 bytes but not 4-byte aligned, and where the key ends before the next 4-byte aligned boundary. In this case, 'keylen -=RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX. This causes a buffer overread and crash during crypto_ahash_setkey(). Proposed upstrem patch: https://lkml.org/lkml/2019/1/21/675
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3545 https://access.redhat.com/errata/RHSA-2020:3545
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10769
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:5437 https://access.redhat.com/errata/RHSA-2020:5437
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:5441 https://access.redhat.com/errata/RHSA-2020:5441