Vulnerability in Kernel: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
Summary
UVI-2021-1000476: crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init. Affects Kernel versions >= 25c6ffb249f612c56a48ce48a3887adf57b8f4bd, < 446045cf682af12d9294765f6c46084b374b5654. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a crucial component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities and services to ensure the proper functioning of the system. One of the components within the Kernel is the crypto subsystem, which handles cryptographic operations. The qat module in the crypto subsystem is used for offloading cryptographic operations to hardware accelerators.
The vulnerability in question arises from a missing initialization step in the qat module. Specifically, the ADF_STATUS_PF_RUNNING flag should be set after the adf_dev_init function is called. However, this flag is not properly set, potentially leading to incorrect behavior and security issues.
Vulnerability Detail
The vulnerability occurs due to the incorrect handling of the ADF_STATUS_PF_RUNNING flag in the qat module of the Kernel's crypto subsystem. When the adf_dev_init function is called, this flag should be set to indicate that the platform is running. However, due to the missing initialization step, the flag remains unset, which can result in various issues.
The impact of this vulnerability is dependent on the specific usage of the qat module and the presence of hardware accelerators. In certain scenarios, it could lead to incorrect cryptographic operations, data corruption, or even potential security breaches.
The vulnerability was introduced in version v4.7 of the Linux Kernel and has been fixed in version v4.14.233 by commit 446045cf682af12d9294765f6c46084b374b5654.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability is fixed in the latest version of the Linux Kernel, applying the update is the recommended approach. However, if updating the Kernel is not immediately feasible, a potential workaround could involve manually modifying the affected code to ensure the ADF_STATUS_PF_RUNNING flag is set after adf_dev_init. Here is an example of the modified code:
// Original code
adf_dev_init();
// Modified code
adf_dev_init();
adf_set_status(ADF_STATUS_PF_RUNNING);
Conclusion
The vulnerability in the Kernel's crypto subsystem, specifically in the qat module, can lead to incorrect behavior and potential security issues. It is crucial to update the Linux Kernel to version v4.14.233 or later to mitigate this vulnerability. Alternatively, a workaround involving manual code modification can be applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the usage of the qat module and the presence of hardware accelerators. It could lead to incorrect cryptographic operations, data corruption, or potential security breaches.
You can use tools like Vulert (https://vulert.com) to check if your system is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities, using a manifest file like package-lock.json to analyze the software.
While updating the Linux Kernel to the latest version is the recommended approach, if immediate update is not feasible, a potential workaround involves manually modifying the affected code to ensure the ADF_STATUS_PF_RUNNING flag is set after adf_dev_init. Please refer to the 'workaround' section for more details.
This vulnerability was introduced in version v4.7 of the Linux Kernel. All versions between v4.7 and v4.14.232 (inclusive) are affected. The vulnerability has been fixed in version v4.14.233 and later.
You can find more information about this vulnerability in the official Linux Kernel repository. The fix commit (446045cf682af12d9294765f6c46084b374b5654) provides detailed information about the issue and the necessary changes made to address it.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
