REDHAT-BUG-2461763: Low severity Linux Linux kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
crypto: afalg - limit RX SG extraction by receive buffer budget
Make afalggetrsgl() limit each RX scatterlist extraction to the remaining receive buffer budget.
afalggetrsgl() currently uses afalgreadable() only as a gate before extracting data into the RX scatterlist. Limit each extraction to the remaining afalgrcvbuf(sk) budget so that receive-side accounting matches the amount of data attached to the request.
If skcipher cannot obtain enough RX space for at least one chunk while more data remains to be processed, reject the recvmsg call instead of rounding the request length down to zero.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2461763?
The severity of REDHAT-BUG-2461763 is considered high due to its potential impact on the integrity of data processed by the Linux kernel.
How do I fix REDHAT-BUG-2461763?
To fix REDHAT-BUG-2461763, update your Linux kernel to the latest version provided by your distribution.
What systems are affected by REDHAT-BUG-2461763?
REDHAT-BUG-2461763 affects systems running vulnerable versions of the Linux kernel that utilize the af_alg interface.
What does the vulnerability REDHAT-BUG-2461763 involve?
REDHAT-BUG-2461763 involves limiting RX scatterlist extraction by implementing a budget check in the af_alg_get_rsgl function.
Has REDHAT-BUG-2461763 been publicly disclosed?
Yes, REDHAT-BUG-2461763 has been publicly disclosed as part of a formal vulnerability announcement.