Vulnerability in Kernel: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
Summary
GSD-2021-1000292: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init. Affects Kernel versions >= 25c6ffb249f612c56a48ce48a3887adf57b8f4bd, < 1ea500ce6f7c9106e4a561d28e69215f3d451818. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages the system's resources and provides an interface for software to interact with the hardware. It is responsible for tasks such as process management, memory management, and device drivers. The vulnerability in question affects the Kernel's crypto subsystem, specifically the qat (QuickAssist Technology) module. The qat module is used for offloading cryptographic operations to dedicated hardware accelerators, improving performance and efficiency. However, a flaw in the implementation of the qat module allows the ADF_STATUS_PF_RUNNING flag to be set before the adf_dev_init function is called, potentially leading to undefined behavior and security vulnerabilities.
Vulnerability Detail
The vulnerability arises from the incorrect setting of the ADF_STATUS_PF_RUNNING flag in the qat module. This flag should only be set after the adf_dev_init function has been called, as it initializes the necessary resources and ensures the module is ready for operation. By setting the flag prematurely, the module may enter an inconsistent state, leading to potential security vulnerabilities. The impact and attack plausibility of this vulnerability have not been proven, but it is essential to address it to maintain the integrity and security of the system.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.12.4 or later. This update includes the necessary fix for the qat module, ensuring that the ADF_STATUS_PF_RUNNING flag is set correctly after the adf_dev_init function. Updating the Kernel can be done by following the official documentation and guidelines provided by the Linux distribution or by directly obtaining the updated Kernel source code from the official Git repository.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can choose to disable or avoid using the qat module until the Kernel is updated to a fixed version. This can be achieved by blacklisting the qat module or removing any configurations or dependencies that rely on it. However, it is recommended to apply the official fix by updating the Kernel as soon as possible to ensure the proper functioning and security of the system.
Conclusion
In conclusion, the vulnerability in the Kernel's crypto subsystem, specifically the qat module, can lead to security vulnerabilities and undefined behavior. It is crucial to update the Kernel to version v5.12.4 or later to fix this vulnerability. Until the update is applied, users can choose to disable or avoid using the qat module as a temporary workaround. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it has the potential to lead to security vulnerabilities and undefined behavior in the Kernel's crypto subsystem. It is crucial to address this vulnerability to maintain the integrity and security of the system.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software. You can visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
Yes, you can choose to disable or avoid using the qat module until the Kernel is updated to a fixed version. This can be done by blacklisting the qat module or removing any configurations or dependencies that rely on it. However, it is recommended to apply the official fix by updating the Kernel as soon as possible.
As of now, there are no known exploits for this vulnerability. However, it is essential to address it promptly to prevent any potential security risks.
You can find more information about this vulnerability, including the fix and its impact, in the official Linux Kernel repository. The vulnerability is tracked under the ID GSD-2021-1000292, and the relevant commit details can be found in the provided references link.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.