REDHAT-BUG-2515351: Medium severity Linux Linux kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: Validate length for CCA AES cipher key requests
ccacipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For s390/zcrypt CCA AES cipher key requests, validate the token length and reject the request early when it exceeds the available space before deriving the CPRB parameter-block copy length.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue is in the Linux kernel's s390/zcrypt code path for CCA AES cipher key requests. Systems that do not use this s390-specific functionality are not indicated as affected by the provided information.
What condition triggers the vulnerable behavior?
A CCA AES cipher key request must contain a key token whose length field exceeds the space available in the CPRB parameter block. The vulnerable code derives the copy length directly from that token length field.
What does the fix change?
The resolved kernel code validates the key token length before copying it into the CPRB parameter block. Requests with token lengths larger than the available parameter-block space are rejected early.