Vulnerability in Kernel Package: crypto: aesni - xts_crypt() return if walk.nbytes is 0
Summary
GSD-2021-1001709: crypto: aesni - xts_crypt() return if walk.nbytes is 0. Affects Kernel versions < 38c84dfafed5b1193d083e0121ccd985ce5f5bdc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software. It includes various subsystems, including the crypto subsystem, which handles cryptographic operations. One of the functions in the crypto subsystem is aesni, which implements the AES-NI instruction set for accelerated AES encryption and decryption. However, a vulnerability has been discovered in the xts_crypt() function of aesni, where the function may return prematurely if the walk.nbytes parameter is 0.
Vulnerability Detail
The vulnerability in the xts_crypt() function of aesni can potentially lead to incorrect encryption or decryption of data. If the walk.nbytes parameter is 0, the function may return without performing the necessary cryptographic operations, resulting in data being left unencrypted or decrypted. This could have serious security implications, as sensitive information could be exposed or tampered with. It is important to note that the impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel package's crypto subsystem, specifically in the xts_crypt() function of the aesni implementation. This vulnerability can lead to incorrect encryption or decryption of data, posing potential security risks. It is recommended to update the Kernel package to version v5.14.10 or a later version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a fundamental component of the Linux operating system, responsible for managing system resources and providing an interface between hardware and software.
The crypto subsystem in the Kernel package handles cryptographic operations, including encryption and decryption.
The aesni function in the crypto subsystem implements the AES-NI instruction set for accelerated AES encryption and decryption.
The xts_crypt() function in aesni is responsible for performing XTS mode encryption or decryption.
The vulnerability could result in incorrect encryption or decryption of data, potentially exposing sensitive information or allowing for tampering with the data.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
