https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 17:14:06 +0000 https://vulnerability.circl.lu/vuln/cve-2022-50731 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: akcipher - default implementation for setting a private key</p> <p>Changes from v1: * removed the default implementation from set_pub_key: it is assumed that an implementation must always have this callback defined as there are no use case for an algorithm, which doesn&#39;t need a public key</p> <p>Many akcipher implementations (like ECDSA) support only signature verifications, so they don&#39;t have all callbacks defined.</p> <p>Commit 78a0324f4a53 (&#34;crypto: akcipher - default implementations for request callbacks&#34;) introduced default callbacks for sign/verify operations, which just return an error code.</p> <p>However, these are not enough, because before calling sign the caller would likely call set_priv_key first on the instantiated transform (as the in-kernel testmgr does). This function does not have a default stub, so the kernel crashes, when trying to set a private key on an akcipher, which doesn&#39;t support signature generation.</p> <p>I&#39;ve noticed this, when trying to add a KAT vector for ECDSA signature to the testmgr.</p> <p>With this patch the testmgr returns an error in dmesg (as it should) instead of crashing the kernel NULL ptr dereference.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: akcipher - default implementation for setting a private key</p> <p>Changes from v1: * removed the default implementation from set_pub_key: it is assumed that an implementation must always have this callback defined as there are no use case for an algorithm, which doesn&#39;t need a public key</p> <p>Many akcipher implementations (like ECDSA) support only signature verifications, so they don&#39;t have all callbacks defined.</p> <p>Commit 78a0324f4a53 (&#34;crypto: akcipher - default implementations for request callbacks&#34;) introduced default callbacks for sign/verify operations, which just return an error code.</p> <p>However, these are not enough, because before calling sign the caller would likely call set_priv_key first on the instantiated transform (as the in-kernel testmgr does). This function does not have a default stub, so the kernel crashes, when trying to set a private key on an akcipher, which doesn&#39;t support signature generation.</p> <p>I&#39;ve noticed this, when trying to add a KAT vector for ECDSA signature to the testmgr.</p> <p>With this patch the testmgr returns an error in dmesg (as it should) instead of crashing the kernel NULL ptr dereference.</p> https://vulnerability.circl.lu/vuln/cve-2022-50731