Description
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component with: memcpy(dst + half_key_sz - len, src, len) When a CRT component is larger than half_key_sz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption. Add a len > half_key_sz check next to the existing !len check for each of the five CRT components so the driver falls back to the non-CRT path instead of writing out of bounds.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
879f77e9071f029e1c9bd5a75814ecf51370f846 to < 6d99c5fadd2df488103f64d6475b63ba6852202baffected879f77e9071f029e1c9bd5a75814ecf51370f846 to < c34369473bfe92a0b46ec78d6358e30341c7f481affected879f77e9071f029e1c9bd5a75814ecf51370f846 to < 1002719d13072a5e4be1e993aa61dffb4a604e82affected879f77e9071f029e1c9bd5a75814ecf51370f846 to < 500319830d76911c120dc0b9605f8c16d7702844affected879f77e9071f029e1c9bd5a75814ecf51370f846 to < 3d61a214fdcda41f1ebfabbb483404032a7b4d91affected879f77e9071f029e1c9bd5a75814ecf51370f846 to < 6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1aaffected879f77e9071f029e1c9bd5a75814ecf51370f846 to < ce42224487c504aee4b7ff3a7342e7b4d7e28cc9affected879f77e9071f029e1c9bd5a75814ecf51370f846 to < b3ac78756588059729b9195fcc9f4b37d54057a5affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b ↗
- https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481 ↗
- https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82 ↗
- https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844 ↗
- https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91 ↗
- https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a ↗
- https://git.kernel.org/stable/c/ce42224487c504aee4b7ff3a7342e7b4d7e28cc9 ↗
- https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5 ↗