Resource leaks in ccp_run_aes_gcm_cmd() in Kernel
Summary
GSD-2021-1001538: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd(). Affects Kernel versions >= 36cf515b9bbe298e1ce7384620f0d4ec45ad3328, < 3707e37b3fcef4d5e9a81b9c2c48ba7248051c2a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The ccp_run_aes_gcm_cmd() function is part of the crypto subsystem in the Kernel and is responsible for executing AES-GCM encryption and decryption commands using the Crypto Co-Processor (CCP).
Vulnerability Detail
The ccp_run_aes_gcm_cmd() function in the Kernel suffers from resource leaks, which can lead to memory and resource exhaustion. These leaks occur when the function fails to release allocated resources properly, such as memory buffers and cryptographic contexts. An attacker could potentially exploit this vulnerability to cause a denial-of-service condition or escalate their privileges. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to apply the fix by updating their Kernel to the latest version.
Conclusion
The resource leaks in ccp_run_aes_gcm_cmd() in the Kernel can lead to memory and resource exhaustion. It is crucial to update the Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from a denial-of-service condition to privilege escalation.
An attacker could potentially exploit this vulnerability to cause a denial-of-service condition or escalate their privileges.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
To fix the vulnerability, users should update their Kernel to the latest version available.
There is no specific workaround mentioned for this vulnerability. Users are advised to apply the fix by updating their Kernel to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
