oss-sec mailing list archives
Re: CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm
From: <cve-assign () mitre org>
Date: Wed, 18 Jan 2017 00:55:40 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Algorithms not compatible with mcryptd could be spawned by mcryptd with a direct crypto_alloc_tfm invocation using a "mcryptd(alg)" name construct. This causes mcryptd to crash the kernel if an arbitrary "alg" is incompatible and not intended to be used with mcryptd. This could be a potential attack to crash the kernel by user program using AF_ALG to request an invalid algorithm such as mcryptd(md5). Initial discussion: https://marc.info/?l=dm-devel&m=148063708010538&w=2 Suggested Patch: http://marc.info/?l=linux-crypto-vger&m=148096718218312&w=2 Red Hat Product Security Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1404200 Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48a992727d82cb7db076fa15d372178743b1f4cdcrypto: mcryptd - Check mcryptd algorithm compatibility
Use CVE-2016-10147. - -- CVE Assignment Team M/S M300, 202 Burlington Road, Bedford, MA 01730 USA [ A PGP key is available for encrypted communications at http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJYfwJ3AAoJEHb/MwWLVhi2Ru0P/0ttpZUnBzHshdCjrphHtTYc QcPtCH6szWvN6LXp/80AukRKXcqrdZ5RHYOf9RmUjqrc5BTXJ9+U6DebtdaHWZFP qdvTKylZqgElgbhVxAQaBH1ToSSc1UTHdyPD21kYojtPbTBEE0amho1nLWx2zizR t1VQTgnvjHn2M2cl0b7khoR2f+gOfbb1b8wo5nzZltlp/brcQ99sqU0x0uI8mbTl 20WzwhLwoONX6kb4MQj56N0GEEFuwU8JRg6hZ0wcPWcnWMUvtHsc6i1ks5CPrNOJ /Zm889icKhKu/bO2jhtYHlqjuIWiM6DSnnbgcGInke7Zp+hHTbTSqbPia9etMsTt nfH4x7MerG9HZyz4NDN8t6Obcblw9So+dtWmp1RIV/jAiNmAx1jl3ubdzFMnxfIH fJNCMLaQu+dNKeaHuV9GEJP/Yz30rTcW66QfeAgaLS3CuuiO+sx/VkIJiRywCZKz 0CQri5/+BIHGxqWeLknNZzrQcEHASQ34W9vVAIkQYKBFRmgHno7oH2LDVPukbwEa KjNTWSuvF+6oqA/TwSZ+T+Tou7l4yPZXF+BIVsO+6Wl7i6LSEVMcHJijK2dbw2wI AVj2lX9Y52yZnPo7PBpWZZlPYMVTiTitp7tRplJPGvCh7Q/P7EJFRcoc/aQrwViX /baDXLh1PIHdI/0LfLKK =qPZQ -----END PGP SIGNATURE-----
Current thread:
- CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm Vladis Dronov (Jan 17)
- Re: CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm Lokesh Ubuntu (Jan 17)
- Re: CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm cve-assign (Jan 17)