Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded. A malformed RESPONSE can therefore use a non-block-aligned ticket length, make the decrypt operation fail, and still drive the ticket parser with attacker-controlled bytes. Check the decrypt result and abort the connection with RXKADBADTICKET when ticket decryption fails.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
17926a79320afa9b95df6b977b40cca6d8713cea to < 252157d939d179b5d767cb860ff8fa7f8723b67aaffected17926a79320afa9b95df6b977b40cca6d8713cea to < a75b3b361dd481d942c5f259a82d59718a41092caffected17926a79320afa9b95df6b977b40cca6d8713cea to < b3a808cd0790b5075aaa2bc3588edf02cd71d352affected17926a79320afa9b95df6b977b40cca6d8713cea to < 47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8aaffected17926a79320afa9b95df6b977b40cca6d8713cea to < a149dcae23309df9de1c3b6b5d468610ef5ab7deaffected17926a79320afa9b95df6b977b40cca6d8713cea to < 22f6258e7b31dba9bf88dce4e3ee7f0f20072e60affected17926a79320afa9b95df6b977b40cca6d8713cea to < 58fcd1b156152613ba00a064a129fb69507ddd7daffected17926a79320afa9b95df6b977b40cca6d8713cea to < fe4447cd95623b1cfacc15f280aab73a6d7340b2affected
Linux Linux
Default version status: affected
2.6.22affected0 to < 2.6.22unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.135 to ≤ 6.6.*unaffected6.12.82 to ≤ 6.12.*unaffected6.18.23 to ≤ 6.18.*unaffected6.19.13 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/252157d939d179b5d767cb860ff8fa7f8723b67a ↗
- https://git.kernel.org/stable/c/a75b3b361dd481d942c5f259a82d59718a41092c ↗
- https://git.kernel.org/stable/c/b3a808cd0790b5075aaa2bc3588edf02cd71d352 ↗
- https://git.kernel.org/stable/c/47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a ↗
- https://git.kernel.org/stable/c/a149dcae23309df9de1c3b6b5d468610ef5ab7de ↗
- https://git.kernel.org/stable/c/22f6258e7b31dba9bf88dce4e3ee7f0f20072e60 ↗
- https://git.kernel.org/stable/c/58fcd1b156152613ba00a064a129fb69507ddd7d ↗
- https://git.kernel.org/stable/c/fe4447cd95623b1cfacc15f280aab73a6d7340b2 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗