Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2024-42229

crypto: aead,cipher - zeroize key buffer after use

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 06817176784f620984200dc5d7cbe16984f7b262 to < 89b9b6fa4463daf820e6a5ef65c3b0c2db239513affected
  • 06817176784f620984200dc5d7cbe16984f7b262 to < b716e9c3603ee95ed45e938fe47227d22cf3ec35affected
  • 06817176784f620984200dc5d7cbe16984f7b262 to < 9db8c299a521813630fcb4154298cb60c37f3133affected
  • 06817176784f620984200dc5d7cbe16984f7b262 to < 71dd428615375e36523f4d4f7685ddd54113646daffected
  • 06817176784f620984200dc5d7cbe16984f7b262 to < 28c8d274848feba552e95c5c2a7e3cfe8f15c534affected
  • 06817176784f620984200dc5d7cbe16984f7b262 to < b502d4a08875ea2b4ea5d5b28dc7c991c8b90cfbaffected
  • 06817176784f620984200dc5d7cbe16984f7b262 to < f58679996a831754a356974376f248aa0af2eb8eaffected
  • 06817176784f620984200dc5d7cbe16984f7b262 to < 23e4099bdc3c8381992f9eb975c79196d6755210affected

Linux Linux

Default version status: affected

  • 2.6.23affected
  • 0 to < 2.6.23unaffected
  • 4.19.323 to ≤ 4.19.*unaffected
  • 5.4.285 to ≤ 5.4.*unaffected
  • 5.10.222 to ≤ 5.10.*unaffected
  • 5.15.163 to ≤ 5.15.*unaffected
  • 6.1.98 to ≤ 6.1.*unaffected
  • 6.6.39 to ≤ 6.6.*unaffected
  • 6.9.9 to ≤ 6.9.*unaffected
  • 6.10 to ≤ *unaffected

References