Critical Vulnerability in Linux Kernel: AEAD Software Fallback Issue
Summary
CVE-2022-49260: In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - fix the aead software fallback for engine Due to the subreq pointer misuse the private context memory. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, vulnerabilities can arise, affecting its reliability and the systems that depend on it. This specific vulnerability relates to the AEAD (Authenticated Encryption with Associated Data) software fallback mechanism, which is crucial for secure data processing.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49260, originates from the misuse of the subreq pointer within the private context memory of the AEAD software fallback in the Linux kernel. This flaw can lead to an operating system panic, particularly when handling large data pages (64K). The implications of this vulnerability are severe, as it can cause system crashes and instability, potentially leading to data loss or service interruptions.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49260 is a critical vulnerability in the Linux kernel that can lead to system crashes due to improper handling of the AEAD software fallback. Users are urged to update their systems to the patched version to ensure stability and security. Monitoring tools like Vulert can help keep your software safe from such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49260 is a vulnerability in the Linux kernel related to the AEAD software fallback mechanism, which can cause system crashes.
This vulnerability can lead to operating system panic, resulting in system instability and potential data loss.
You should update your Linux kernel to version 5.17.3-1 or later to mitigate the vulnerability.
No specific workarounds are available; applying the patch is the recommended solution.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json. You can check your application for vulnerabilities without signup at the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
