Vulnerability in crypto: hisilicon/sec package - aead software fallback for engine
Summary
GSD-2022-1001897: crypto: hisilicon/sec - fix the aead software fallback for engine. Affects Kernel versions >= 6c46a3297beae4ae2d22b26da5e091f058381c7c, < 40dba7c26e897c637e91312b35f664f1d4d0073c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The crypto: hisilicon/sec package is a component of the Linux Kernel, which is responsible for providing cryptographic functionality. It includes support for hardware acceleration using the Hisilicon SEC engine. The engine offloads cryptographic operations to dedicated hardware, improving performance and security. However, a vulnerability has been discovered in the aead software fallback mechanism of the engine.
Vulnerability Detail
The vulnerability in the crypto: hisilicon/sec package affects the aead software fallback mechanism of the Hisilicon SEC engine. When the hardware acceleration is unavailable or disabled, the engine falls back to software-based encryption and decryption. However, due to a coding error, this fallback mechanism is not properly implemented, leading to potential security weaknesses. An attacker may exploit this vulnerability to perform cryptographic attacks or gain unauthorized access to sensitive information. The vulnerability was introduced in version v5.14 of the Linux Kernel and has been fixed in version v5.15.33.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Linux Kernel is not immediately feasible, a temporary workaround is to disable the Hisilicon SEC engine or ensure that hardware acceleration is enabled. This will prevent the fallback to the vulnerable software-based encryption and decryption. However, it is strongly advised to apply the official fix as soon as possible.
Conclusion
The vulnerability in the crypto: hisilicon/sec package's aead software fallback mechanism of the Hisilicon SEC engine can pose significant security risks. It is crucial to update the Linux Kernel to version v5.15.33 or later to apply the fix. If immediate updating is not possible, consider disabling the Hisilicon SEC engine or enabling hardware acceleration as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability in the aead software fallback mechanism of the Hisilicon SEC engine can potentially lead to cryptographic attacks or unauthorized access to sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is essential to apply the fix promptly to mitigate any potential risks.
Yes, you can temporarily disable the Hisilicon SEC engine or ensure that hardware acceleration is enabled to prevent the fallback to the vulnerable software-based encryption and decryption. However, it is strongly recommended to update the Linux Kernel to the fixed version as soon as possible.
You can refer to the Linux Kernel repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ for more details about the fix and the vulnerability. Additionally, the vulnerability details are available in the GSD database maintained by the Cloud Security Alliance at https://github.com/cloudsecurityalliance/gsd-database.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
