Critical Vulnerability in Linux Kernel: Inadequate Zeroization of Private Key
Summary
CVE-2024-42098: In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh - explicitly zeroize private_key private_key is overwritten with the key parameter passed in by the caller (if present), or alternatively a... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources and facilitates communication between software and hardware. This vulnerability affects the cryptographic functionality of the kernel, specifically in the Elliptic Curve Diffie-Hellman (ECDH) key exchange process, where the private key may not be properly zeroized, leading to potential security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ECDH cryptographic function where the private_key may not be fully zeroized when a new key is generated or provided by the caller. If the new key is shorter than the previous key, remnants of the old key may remain in memory, exposing sensitive key material. This flaw could lead to unauthorized access or exploitation of cryptographic operations, compromising the security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can ensure that the private_key is explicitly zeroized before any new key is assigned. This can be done by adding the following code snippet in the relevant section of the cryptographic function:
memset(private_key, 0, sizeof(private_key));
Conclusion
The vulnerability CVE-2024-42098 in the Linux kernel poses a significant risk due to inadequate zeroization of the private key in cryptographic functions. Users are strongly advised to update their systems to the latest fixed versions or implement the recommended workaround to mitigate potential security threats.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to exposure of sensitive cryptographic keys, potentially allowing unauthorized access to secure communications.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
All versions prior to the fixed versions 6.1.98-1 for Debian 12 and 6.9.8-1 for Debian 13 are affected.
Yes, updating to the specified fixed versions of the Linux kernel will permanently resolve this vulnerability.
If an immediate update is not possible, implement the provided workaround to zeroize the private_key before assigning a new key.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
