CVE-2024-42098

crypto: ecdh - explicitly zeroize private_key

published July 29, 2024

CVSS
—
EPSS
0%
Percentile
10.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

crypto: ecdh - explicitly zeroize private_key

private_key is overwritten with the key parameter passed in by the

caller (if present), or alternatively a newly generated private key.

However, it is possible that the caller provides a key (or the newly

generated key) which is shorter than the previous key. In that

scenario, some key material from the previous key would not be

overwritten. The easiest solution is to explicitly zeroize the entire

private_key array first.

Note that this patch slightly changes the behavior of this function:

previously, if the ecc_gen_privkey failed, the old private_key would

remain. Now, the private_key is always zeroized. This behavior is

consistent with the case where params.key is set and ecc_is_key_valid

fails.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.7th percentile
Published
2024-07-29T17:39Z
EPSS history
Timeline
  • 29 JUL 17:39Z
    crypto: ecdh - explicitly zeroize private_key
    cvelistv5