CVE-2024-26789: crypto: arm64/neonbs - fix out-of-bounds access on short input
crypto: arm64/neonbs - fix out-of-bounds access on short input
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.85.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch crypto: arm64/neonbs - fix out-of-bounds access on short input - Configuration
Apply the described workaround in the affected plain NEON glue path so that inputs/outputs shorter than 16 bytes are copied into a temporary buffer before invoking the NEON asm helper, avoiding out-of-bounds accesses due to 16-byte granule memory accesses.
crypto: arm64/neonbs (AES-CTR NEON fallback) plain NEON glue short-input handling = use a temporary buffer for short in/outputs (copy inputs shorter than 16 bytes into temp buffer)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26789?
CVE-2024-26789 has been classified as a high-severity vulnerability due to the potential for out-of-bounds access.
How do I fix CVE-2024-26789?
To fix CVE-2024-26789, upgrade to Linux kernel versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2024-26789?
CVE-2024-26789 affects systems running specific versions of the Linux kernel that utilize the NEON implementation for AES-CTR.
Is CVE-2024-26789 exploitable remotely?
CVE-2024-26789 is not typically considered remotely exploitable but may affect local users through specially crafted inputs.
What are the consequences of not addressing CVE-2024-26789?
Ignoring CVE-2024-26789 may lead to potential security risks, including unauthorized access to system memory.