Critical Vulnerability in Linux Package: Improper SG Use in DCP Trusted Keys
Summary
DEBIAN-CVE-2024-58008: In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y With vmalloc stack addresses enabled (CONFIG_VMAP_STACK=y) DCP trusted keys can crash d... Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, providing essential services for hardware management, process control, and system security. It is widely used in various distributions, including Debian 13 and 14. The kernel's functionality is crucial for system stability and performance, making it a prime target for vulnerabilities that can compromise system integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of trusted keys within the DCP crypto driver. When the vmalloc stack addresses are enabled (CONFIG_VMAP_STACK=y), the DCP trusted keys can lead to crashes during the encryption and decryption processes of the blob encryption key. This issue arises from the improper use of the sg_init_one() function with vmalloc'd stack buffers, specifically the plain_key_blob. The ramifications of this vulnerability include potential system crashes and compromised security during cryptographic operations.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the CONFIG_VMAP_STACK option in the kernel configuration, although this may not be a viable long-term solution. It is recommended to apply the patch as soon as possible.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to system stability and security. It is crucial for users to update to the patched version (6.12.15-1) to protect their systems. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of stack buffers in the DCP crypto driver, which can lead to system crashes.
The vulnerability affects all versions prior to 6.12.15-1 in both Debian 13 and 14.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without needing to install any code.
The primary consequence is system instability, which can lead to crashes during cryptographic operations.
Disabling the CONFIG_VMAP_STACK option can serve as a temporary workaround, but applying the patch is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
