Vulnerability in Kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
Summary
GSD-2021-1001603: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd(). Affects Kernel versions >= 36cf515b9bbe298e1ce7384620f0d4ec45ad3328, < 24f3d2609114f1e1f6b487b511ce5fa36f21e0ae. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces between hardware and software. It is responsible for managing system resources, including memory, processes, and device drivers. The crypto subsystem within the Kernel provides cryptographic algorithms and services for secure communication and data protection. One of the components in the crypto subsystem is the ccp (Cryptographic Coprocessor) module, which offloads cryptographic operations to specialized hardware for improved performance.
The vulnerability identified in the ccp module relates to resource leaks in the ccp_run_aes_gcm_cmd() function. Resource leaks occur when system resources, such as memory or file descriptors, are not properly released after use. These leaks can lead to resource exhaustion, degraded system performance, and potential security vulnerabilities.
Vulnerability Detail
The vulnerability in ccp_run_aes_gcm_cmd() was introduced in version v4.12 of the Linux Kernel by commit 36cf515b9bbe298e1ce7384620f0d4ec45ad3328. It was fixed in version v5.4.151 by commit 24f3d2609114f1e1f6b487b511ce5fa36f21e0ae. The vulnerability manifests as resource leaks, which can be exploited by an attacker to exhaust system resources, potentially leading to denial-of-service (DoS) conditions or other security risks.
The impact and attack plausibility of this vulnerability have not been proven, but it is essential to address the issue to prevent potential exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability has been fixed in the latest version of the Linux Kernel, there is no specific workaround available. It is recommended to update to the fixed version as soon as possible.
Conclusion
The vulnerability in the Kernel's ccp module, specifically in the ccp_run_aes_gcm_cmd() function, can result in resource leaks that may lead to resource exhaustion and potential security risks. It is crucial to update the Linux Kernel to version v5.4.151 or later to fix this vulnerability. No known exploits exist at the time of this report, but prompt remediation is recommended. For additional support, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific system and its usage. However, resource leaks can lead to resource exhaustion, degraded system performance, and potential security risks.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
At the time of this report, there are no known exploits for this vulnerability. However, it is crucial to address the issue promptly to mitigate potential risks.
The remote exploitability of this vulnerability has not been proven. However, it is always recommended to keep systems up to date with the latest security patches to minimize the risk of remote exploitation.
For further support and assistance with vulnerability remediation, you can reach out to info@devnack.com. Our team of experts is ready to help you address and mitigate security vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
