Bug 1708775 (CVE-2020-10769) - CVE-2020-10769 kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not aligned.
Summary: CVE-2020-10769 kernel: Buffer over-read in crypto_authenc_extractkeys() when ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10769
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1846104 1846105 1846355
Blocks: 1708776 1869392
TreeView+ depends on / blocked
 
Reported: 2019-05-10 20:15 UTC by Pedro Sampaio
Modified: 2023-12-15 16:29 UTC (History)
53 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A buffer over-read flaw was found in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.
Clone Of:
Environment:
Last Closed: 2020-08-25 19:17:31 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:0138 0 None None None 2021-01-14 11:41:22 UTC
Red Hat Product Errata RHSA-2020:3545 0 None None None 2020-08-25 13:13:38 UTC
Red Hat Product Errata RHSA-2020:5437 0 None None None 2020-12-15 11:11:51 UTC
Red Hat Product Errata RHSA-2020:5441 0 None None None 2020-12-15 11:16:44 UTC

Description Pedro Sampaio 2019-05-10 20:15:18 UTC
A buffer overread problem was found in crypto_authenc_extractkeys in crypto/authenc.c in IPsec Cryptographic algorithms module authenc. When a payload longer than 4 bytes, is not following a 4-byte alignment boundary guidelines, may cause a buffer overread threat, leading to a system crash problem. An attacker locally with a user privilege can cause a denial of service (DoS).  

crypto_authenc_extractkeys() fails to consider the case where the rtattr's payload is longer than 4 bytes but not 4-byte aligned, and where the key ends before the next 4-byte aligned boundary.  In this case, 'keylen -=RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX.  This causes a buffer overread and crash during  crypto_ahash_setkey().

Proposed upstrem patch:

https://lkml.org/lkml/2019/1/21/675

Comment 4 Rohit Keshri 2020-06-10 18:48:32 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 12 errata-xmlrpc 2020-08-25 13:13:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3545 https://access.redhat.com/errata/RHSA-2020:3545

Comment 13 Product Security DevOps Team 2020-08-25 19:17:31 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10769

Comment 14 errata-xmlrpc 2020-12-15 11:11:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:5437 https://access.redhat.com/errata/RHSA-2020:5437

Comment 15 errata-xmlrpc 2020-12-15 11:16:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:5441 https://access.redhat.com/errata/RHSA-2020:5441


Note You need to log in before you can comment on or make changes to this bug.