ima: Fix Reference Leak in asymmetric_verify() in Linux Kernel
Summary
GSD-2022-1000484: ima: fix reference leak in asymmetric_verify(). Affects Kernel versions >= 947d70597236dd5ae65c1f68c8eabfb962ee5a6b, < 89f586d3398f4cc0432ed870949dffb702940754. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for the operating system, including managing system resources, device drivers, and security features. One of the security features implemented in the Linux Kernel is the Integrity Measurement Architecture (IMA), which verifies the integrity of files and processes. The asymmetric_verify() function in IMA is responsible for verifying the signature of an asymmetric key. However, a reference leak vulnerability was discovered in this function, which could lead to resource exhaustion and potential security breaches.
Vulnerability Detail
The vulnerability in the asymmetric_verify() function of IMA allows an attacker to cause a reference leak, leading to resource exhaustion. By repeatedly triggering the verification process with specially crafted data, an attacker can exhaust system resources, potentially causing denial-of-service conditions or other security issues. The vulnerability was introduced in Linux Kernel version v5.13 and was fixed in version v5.16.10.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating the Linux Kernel.
Conclusion
The reference leak vulnerability in the asymmetric_verify() function of IMA in the Linux Kernel can lead to resource exhaustion and potential security breaches. It is recommended to update the Linux Kernel to version v5.16.10 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can lead to resource exhaustion, potentially causing denial-of-service conditions or other security issues.
You can check the version of the Linux Kernel installed on your system. If it is version v5.13 or later and does not include the fix commit (89f586d3398f4cc0432ed870949dffb702940754), your system may be affected.
There are no known exploits for this vulnerability at the time of this report.
The vulnerability requires the attacker to have the ability to trigger the verification process with specially crafted data. Therefore, remote exploitation is unlikely unless the attacker has already gained access to the target system.
There is no evidence of active attacks exploiting this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
