Vulnerability in Linux Kernel: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
Summary
GSD-2021-1000461: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init. Affects Kernel versions >= 25c6ffb249f612c56a48ce48a3887adf57b8f4bd, < 09d16cee6285d37cc76311c29add6d97a7e4acda. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality and interfaces for hardware, software, and user applications. The crypto subsystem in the Linux Kernel includes cryptographic algorithms and related components. One of these components is the QuickAssist Technology (QAT) driver, which offloads cryptographic operations to dedicated hardware accelerators. The QAT driver enables faster and more efficient cryptographic processing. However, a vulnerability has been identified in the QAT driver, specifically in the handling of the ADF_STATUS_PF_RUNNING flag. This flag should be set after the initialization of the adf_dev structure, but it is not properly set in affected versions of the Linux Kernel.
Vulnerability Detail
The vulnerability in the QAT driver of the Linux Kernel allows an attacker to potentially exploit the improper handling of the ADF_STATUS_PF_RUNNING flag. By manipulating this flag, an attacker may be able to execute arbitrary code or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet, but it is important to address it to ensure the security and stability of systems running the affected versions of the Linux Kernel.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the latest stable version.
Conclusion
The vulnerability in the QAT driver of the Linux Kernel, related to the improper handling of the ADF_STATUS_PF_RUNNING flag, can have serious security implications. It is crucial to update the Linux Kernel to the latest stable version that includes the fix for this vulnerability. Regularly updating the Linux Kernel is a good practice to ensure the overall security and stability of systems. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is an open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality and interfaces for hardware, software, and user applications.
The QAT driver in the Linux Kernel is responsible for offloading cryptographic operations to dedicated hardware accelerators, enabling faster and more efficient cryptographic processing.
The ADF_STATUS_PF_RUNNING flag is a status flag used in the QAT driver to indicate the running state of the adf_dev structure, which is initialized during the driver initialization process.
The potential consequences of this vulnerability include the execution of arbitrary code by an attacker or the occurrence of a denial-of-service condition, depending on the attacker's capabilities and the specific system configuration.
To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v4.19.191 or later, which includes the fix for this issue. Regularly updating the Linux Kernel is also advisable to stay protected against security vulnerabilities and benefit from bug fixes.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
