cve-2024-38578
Vulnerability from cvelistv5
Published
2024-06-19 13:37
Modified
2024-09-11 17:34
Severity
Summary
ecryptfs: Fix buffer size for tag 66 packet
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.680Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1c125b9287e58f364d82174efb167414b92b11f1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/235b85981051cd68fc215fd32a81c6f116bfc4df"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/edbfc42ab080e78c6907d40a42c9d10b69e445c1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/12db25a54ce6bb22b0af28010fff53ef9cb3fe93"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d0f8ba042af16519f1ef7dd10463a33b21b677c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2ed750b7ae1b5dc72896d7dd114c419afd3d1910"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a20f09452e2f58f761d11ad7b96b5c894c91030e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f6008487f1eeb8693f8d2a36a89c87d9122ddf74"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/85a6a1aff08ec9f5b929d345d066e2830e8818e5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:14:06.312936Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:55.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ecryptfs/keystore.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1c125b9287e5",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            },
            {
              "lessThan": "235b85981051",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            },
            {
              "lessThan": "edbfc42ab080",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            },
            {
              "lessThan": "12db25a54ce6",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            },
            {
              "lessThan": "0d0f8ba042af",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            },
            {
              "lessThan": "2ed750b7ae1b",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            },
            {
              "lessThan": "a20f09452e2f",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            },
            {
              "lessThan": "f6008487f1ee",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            },
            {
              "lessThan": "85a6a1aff08e",
              "status": "affected",
              "version": "dddfa461fc89",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ecryptfs/keystore.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.21"
            },
            {
              "lessThan": "2.6.21",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: Fix buffer size for tag 66 packet\n\nThe \u0027TAG 66 Packet Format\u0027 description is missing the cipher code and\nchecksum fields that are packed into the message packet. As a result,\nthe buffer allocated for the packet is 3 bytes too small and\nwrite_tag_66_packet() will write up to 3 bytes past the end of the\nbuffer.\n\nFix this by increasing the size of the allocation so the whole packet\nwill always fit in the buffer.\n\nThis fixes the below kasan slab-out-of-bounds bug:\n\n  BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0\n  Write of size 1 at addr ffff88800afbb2a5 by task touch/181\n\n  CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4c/0x70\n   print_report+0xc5/0x610\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   ? kasan_complete_mode_report_info+0x44/0x210\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   kasan_report+0xc2/0x110\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   __asan_store1+0x62/0x80\n   ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10\n   ? __alloc_pages+0x2e2/0x540\n   ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d]\n   ? dentry_open+0x8f/0xd0\n   ecryptfs_write_metadata+0x30a/0x550\n   ? __pfx_ecryptfs_write_metadata+0x10/0x10\n   ? ecryptfs_get_lower_file+0x6b/0x190\n   ecryptfs_initialize_file+0x77/0x150\n   ecryptfs_create+0x1c2/0x2f0\n   path_openat+0x17cf/0x1ba0\n   ? __pfx_path_openat+0x10/0x10\n   do_filp_open+0x15e/0x290\n   ? __pfx_do_filp_open+0x10/0x10\n   ? __kasan_check_write+0x18/0x30\n   ? _raw_spin_lock+0x86/0xf0\n   ? __pfx__raw_spin_lock+0x10/0x10\n   ? __kasan_check_write+0x18/0x30\n   ? alloc_fd+0xf4/0x330\n   do_sys_openat2+0x122/0x160\n   ? __pfx_do_sys_openat2+0x10/0x10\n   __x64_sys_openat+0xef/0x170\n   ? __pfx___x64_sys_openat+0x10/0x10\n   do_syscall_64+0x60/0xd0\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n  RIP: 0033:0x7f00a703fd67\n  Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f\n  RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\n  RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67\n  RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c\n  RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000\n  R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941\n  R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040\n   \u003c/TASK\u003e\n\n  Allocated by task 181:\n   kasan_save_stack+0x2f/0x60\n   kasan_set_track+0x29/0x40\n   kasan_save_alloc_info+0x25/0x40\n   __kasan_kmalloc+0xc5/0xd0\n   __kmalloc+0x66/0x160\n   ecryptfs_generate_key_packet_set+0x6d2/0xde0\n   ecryptfs_write_metadata+0x30a/0x550\n   ecryptfs_initialize_file+0x77/0x150\n   ecryptfs_create+0x1c2/0x2f0\n   path_openat+0x17cf/0x1ba0\n   do_filp_open+0x15e/0x290\n   do_sys_openat2+0x122/0x160\n   __x64_sys_openat+0xef/0x170\n   do_syscall_64+0x60/0xd0\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-15T06:48:26.077Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1c125b9287e58f364d82174efb167414b92b11f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/235b85981051cd68fc215fd32a81c6f116bfc4df"
        },
        {
          "url": "https://git.kernel.org/stable/c/edbfc42ab080e78c6907d40a42c9d10b69e445c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/12db25a54ce6bb22b0af28010fff53ef9cb3fe93"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d0f8ba042af16519f1ef7dd10463a33b21b677c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ed750b7ae1b5dc72896d7dd114c419afd3d1910"
        },
        {
          "url": "https://git.kernel.org/stable/c/a20f09452e2f58f761d11ad7b96b5c894c91030e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6008487f1eeb8693f8d2a36a89c87d9122ddf74"
        },
        {
          "url": "https://git.kernel.org/stable/c/85a6a1aff08ec9f5b929d345d066e2830e8818e5"
        }
      ],
      "title": "ecryptfs: Fix buffer size for tag 66 packet",
      "x_generator": {
        "engine": "bippy-c9c4e1df01b2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38578",
    "datePublished": "2024-06-19T13:37:36.487Z",
    "dateReserved": "2024-06-18T19:36:34.926Z",
    "dateUpdated": "2024-09-11T17:34:55.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38578\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:17.870\",\"lastModified\":\"2024-07-15T07:15:10.620\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\necryptfs: Fix buffer size for tag 66 packet\\n\\nThe \u0027TAG 66 Packet Format\u0027 description is missing the cipher code and\\nchecksum fields that are packed into the message packet. As a result,\\nthe buffer allocated for the packet is 3 bytes too small and\\nwrite_tag_66_packet() will write up to 3 bytes past the end of the\\nbuffer.\\n\\nFix this by increasing the size of the allocation so the whole packet\\nwill always fit in the buffer.\\n\\nThis fixes the below kasan slab-out-of-bounds bug:\\n\\n  BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0\\n  Write of size 1 at addr ffff88800afbb2a5 by task touch/181\\n\\n  CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x4c/0x70\\n   print_report+0xc5/0x610\\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\\n   ? kasan_complete_mode_report_info+0x44/0x210\\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\\n   kasan_report+0xc2/0x110\\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\\n   __asan_store1+0x62/0x80\\n   ecryptfs_generate_key_packet_set+0x7d6/0xde0\\n   ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10\\n   ? __alloc_pages+0x2e2/0x540\\n   ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d]\\n   ? dentry_open+0x8f/0xd0\\n   ecryptfs_write_metadata+0x30a/0x550\\n   ? __pfx_ecryptfs_write_metadata+0x10/0x10\\n   ? ecryptfs_get_lower_file+0x6b/0x190\\n   ecryptfs_initialize_file+0x77/0x150\\n   ecryptfs_create+0x1c2/0x2f0\\n   path_openat+0x17cf/0x1ba0\\n   ? __pfx_path_openat+0x10/0x10\\n   do_filp_open+0x15e/0x290\\n   ? __pfx_do_filp_open+0x10/0x10\\n   ? __kasan_check_write+0x18/0x30\\n   ? _raw_spin_lock+0x86/0xf0\\n   ? __pfx__raw_spin_lock+0x10/0x10\\n   ? __kasan_check_write+0x18/0x30\\n   ? alloc_fd+0xf4/0x330\\n   do_sys_openat2+0x122/0x160\\n   ? __pfx_do_sys_openat2+0x10/0x10\\n   __x64_sys_openat+0xef/0x170\\n   ? __pfx___x64_sys_openat+0x10/0x10\\n   do_syscall_64+0x60/0xd0\\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\\n  RIP: 0033:0x7f00a703fd67\\n  Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f\\n  RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\\n  RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67\\n  RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c\\n  RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000\\n  R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941\\n  R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 181:\\n   kasan_save_stack+0x2f/0x60\\n   kasan_set_track+0x29/0x40\\n   kasan_save_alloc_info+0x25/0x40\\n   __kasan_kmalloc+0xc5/0xd0\\n   __kmalloc+0x66/0x160\\n   ecryptfs_generate_key_packet_set+0x6d2/0xde0\\n   ecryptfs_write_metadata+0x30a/0x550\\n   ecryptfs_initialize_file+0x77/0x150\\n   ecryptfs_create+0x1c2/0x2f0\\n   path_openat+0x17cf/0x1ba0\\n   do_filp_open+0x15e/0x290\\n   do_sys_openat2+0x122/0x160\\n   __x64_sys_openat+0xef/0x170\\n   do_syscall_64+0x60/0xd0\\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ecryptfs: corrige el tama\u00f1o del b\u00fafer para el paquete etiqueta 66. A la descripci\u00f3n \u0027Formato de paquete TAG 66\u0027 le faltan el c\u00f3digo de cifrado y los campos de suma de verificaci\u00f3n que est\u00e1n empaquetados en el paquete de mensaje. Como resultado, el b\u00fafer asignado para el paquete es 3 bytes demasiado peque\u00f1o y write_tag_66_packet() escribir\u00e1 hasta 3 bytes m\u00e1s all\u00e1 del final del b\u00fafer. Solucione este problema aumentando el tama\u00f1o de la asignaci\u00f3n para que todo el paquete siempre quepa en el b\u00fafer. Esto corrige el siguiente error de kasan slab-out-of-bounds: ERROR: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0 Escritura de tama\u00f1o 1 en la direcci\u00f3n ffff88800afbb2a5 mediante tarea t\u00e1ctil/181 CPU: 0 PID: 181 Comm : touch No contaminado 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 01/04/2014 Seguimiento de llamadas:  3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX : ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67 RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c RBP: 00007ffc088e4 8d7 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941 R13: 00000 R14: 00007ffc088e48d7 R15: 00007f00a7180040  Asignado por tarea 181: kasan_save_stack+0x2f/0x60 kasan_set_track+0x29/0x40 kasan_save_alloc_info+0x25/0x40 __kasan_kmalloc+0xc5/0xd0 __kmalloc+0x66/0x160 ecryptfs_generate_key_packet_set+0x6d2/0xde0 _write_metadata+0x30a/0x550 ecryptfs_initialize_file+0x77/0x150 ecryptfs_create+0x1c2/0x2f0 ruta_openat+ 0x17cf/0x1ba0 do_filp_open+0x15e/0x290 do_sys_openat2+0x122/0x160 __x64_sys_openat+0xef/0x170 do_syscall_64+0x60/0xd0 Entry_SYSCALL_64_after_hwframe+0x6e/0xd8\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d0f8ba042af16519f1ef7dd10463a33b21b677c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/12db25a54ce6bb22b0af28010fff53ef9cb3fe93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1c125b9287e58f364d82174efb167414b92b11f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/235b85981051cd68fc215fd32a81c6f116bfc4df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2ed750b7ae1b5dc72896d7dd114c419afd3d1910\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/85a6a1aff08ec9f5b929d345d066e2830e8818e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a20f09452e2f58f761d11ad7b96b5c894c91030e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/edbfc42ab080e78c6907d40a42c9d10b69e445c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f6008487f1eeb8693f8d2a36a89c87d9122ddf74\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading...

Loading...