Vulnerability in Kernel: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
Summary
GSD-2021-1000389: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init. Affects Kernel versions >= 25c6ffb249f612c56a48ce48a3887adf57b8f4bd, < 1f50392650ae794a1aea41c213c6a3e1c824413c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and acts as an interface between hardware and software. It is responsible for managing system resources, including memory, processes, and device drivers. The vulnerability in question affects the crypto subsystem of the Kernel, specifically the qat (QuickAssist Technology) driver. The qat driver is used to offload cryptographic operations to dedicated hardware accelerators, improving performance and efficiency. However, a flaw in the driver's initialization process allows the ADF_STATUS_PF_RUNNING flag to be set before adf_dev_init is completed, potentially leading to undefined behavior and security vulnerabilities.
Vulnerability Detail
The vulnerability arises from the incorrect setting of the ADF_STATUS_PF_RUNNING flag in the qat driver's initialization process. This flag should only be set after adf_dev_init has completed successfully. By setting the flag prematurely, the driver may enter an inconsistent state, potentially leading to security vulnerabilities and unpredictable behavior. The impact of this vulnerability is dependent on the specific usage of the qat driver and the potential security vulnerabilities that may arise from its incorrect initialization. It is important to note that the actual impact and attack plausibility have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the qat driver if it is not essential for their system's operation. This can be achieved by blacklisting the qat driver module or removing it from the Kernel configuration. However, this workaround may impact the performance and functionality of systems that rely on the qat driver for cryptographic operations.
Conclusion
In conclusion, the vulnerability in the Kernel's qat driver arises from the incorrect setting of the ADF_STATUS_PF_RUNNING flag during initialization. This can lead to unpredictable behavior and potential security vulnerabilities. It is recommended to update the Kernel to a version that includes the fix for this vulnerability. Users can also consider disabling the qat driver as a temporary workaround, although this may impact system performance and functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The qat driver is a component of the Kernel's crypto subsystem that enables offloading of cryptographic operations to dedicated hardware accelerators, improving performance and efficiency.
adf_dev_init is a function within the qat driver that initializes the hardware accelerator devices and prepares them for operation.
The specific security vulnerabilities that may arise from this vulnerability are not yet proven or documented. However, the incorrect initialization of the qat driver may lead to unpredictable behavior and potential security vulnerabilities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation. Simply upload your package-lock.json file to the Vulert Playground and it will analyze and report any vulnerabilities found.
As of now, there is no known exploit for this vulnerability. However, it is important to promptly update the Kernel to the fixed version to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
