CVE-2024-58008: KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
In the Linux kernel, the following vulnerability has been resolved:
KEYS: trusted: dcp: fix improper sg use with CONFIGVMAPSTACK=y
With vmalloc stack addresses enabled (CONFIGVMAPSTACK=y) DCP trusted keys can crash during en- and decryption of the blob encryption key via the DCP crypto driver. This is caused by improperly using sginitone() with vmalloc'd stack buffers (plainkeyblob).
Fix this by always using kmalloc() for buffers we give to the DCP crypto driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.15-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Always allocate buffers passed to the DCP crypto driver with kmalloc(), including the plain_key_blob buffers, instead of using vmalloc-backed stack buffers with sg_init_one().
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58008?
CVE-2024-58008 is classified as a high severity vulnerability due to the potential for system crashes during key encryption processes.
How do I fix CVE-2024-58008?
To fix CVE-2024-58008, update your Linux kernel to the latest version above 6.13.3, or apply the provided patches.
What versions of the Linux kernel are affected by CVE-2024-58008?
CVE-2024-58008 affects Linux kernel versions from 6.10.7 up to and including 6.13.3, as well as specific release candidates.
What is the impact of CVE-2024-58008 on my system?
The impact of CVE-2024-58008 includes potential system instability and crashes when handling trusted keys in the Linux kernel.
Is CVE-2024-58008 a remote attack vulnerability?
CVE-2024-58008 is not specifically a remote attack vulnerability but pertains to local operations involving trusted key management.