Medium · published June 19, 2024
In the Linux kernel, the following vulnerability has been resolved:
crypto: bcm - Fix pointer arithmetic
In spu2_dump_omd() value of ptr is increased by ciph_key_len
instead of hash_iv_len which could lead to going beyond the
buffer boundaries.
Fix this bug by changing ciph_key_len to hash_iv_len.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.11, < 4.19.316 | 4.19.316 |
| linux/linux_kernel | ≥ 4.20, < 5.4.278 | 5.4.278 |
| linux/linux_kernel | ≥ 5.5, < 5.10.219 | 5.10.219 |
| linux/linux_kernel | ≥ 5.11, < 5.15.161 | 5.15.161 |
| linux/linux_kernel | ≥ 5.16, < 6.1.93 | 6.1.93 |
| linux/linux_kernel | ≥ 6.2, < 6.6.33 | 6.6.33 |
| linux/linux_kernel | ≥ 6.7, < 6.8.12 | 6.8.12 |
| linux/linux_kernel | ≥ 6.9, < 6.9.3 | 6.9.3 |