CVE-2024-26763: dm-crypt: don't modify the data when using authenticated encryption
In the Linux kernel, the following vulnerability has been resolved:
dm-crypt: don't modify the data when using authenticated encryption
It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio.
This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with ODIRECT and modifying them at the same time.
[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26763?
CVE-2024-26763 is classified as a medium severity vulnerability due to the potential for data integrity issues.
How do I fix CVE-2024-26763?
To mitigate CVE-2024-26763, update the Linux kernel to a safe version such as 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
What vulnerabilities does CVE-2024-26763 address?
CVE-2024-26763 addresses issues with the dm-crypt implementation that could lead to invalid tag production when authenticated encryption is performed on modified data.
Which systems are affected by CVE-2024-26763?
CVE-2024-26763 affects systems running vulnerable versions of the Linux kernel, notably those using the dm-crypt module.
Is CVE-2024-26763 exploitable remotely?
CVE-2024-26763 is not considered remotely exploitable as it requires local access to the affected system to exploit the vulnerability.