Kernel Vulnerability in Linux Package: Use After Free in sun8i_ce_cipher_unprepare
Summary
DEBIAN-CVE-2024-27061: In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Fix use after free in unprepare sun8i_ce_cipher_unprepare should be called before crypto_finalize_skcipher_request, because client ca... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient operation and security. This vulnerability specifically affects the crypto subsystem, which handles cryptographic operations, making it critical for maintaining data integrity and confidentiality.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the crypto subsystem related to the sun8i_ce_cipher_unprepare function. This issue arises from a use-after-free condition, where memory that has already been freed is accessed again. This can lead to a kernel NULL pointer dereference, causing system crashes or unexpected behavior. The vulnerability is triggered when client callbacks free memory that is still needed by the unprepare function, resulting in potential exploitation during cryptographic operations.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling the affected cryptographic operations until the patch is applied. However, this may impact the functionality of applications relying on cryptography.
Conclusion
The identified vulnerability in the Linux kernel's crypto subsystem poses significant risks to system stability and security. Users are strongly advised to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to crashes or exploitation.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Not addressing this vulnerability can lead to system instability, crashes, and potential exploitation by malicious actors, compromising the security of your system.
Yes, the vulnerability affects the Linux packages in Debian versions 13 and 14 prior to the patched version 6.7.12-1.
If immediate updates are not possible, consider disabling cryptographic operations that rely on the affected functions as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
