CVE-2022-48630

crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ

published March 5, 2024

CVSS
—
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ

The commit referenced in the Fixes tag removed the 'break' from the else

branch in qcom_rng_read(), causing an infinite loop whenever 'max' is

not a multiple of WORD_SZ. This can be reproduced e.g. by running:

kcapi-rng -b 67 >/dev/null

There are many ways to fix this without adding back the 'break', but

they all seem more awkward than simply adding it back, so do just that.

Tested on a machine with Qualcomm Amberwing processor.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Published
2024-03-05T11:18Z
EPSS history
Timeline
  • 05 MAR 11:18Z
    crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
    cvelistv5