Executive brief
A vulnerability in the Linux kernel's Xilinx crypto driver could allow a local user to cause a system crash. The issue occurs when the system handles certain cryptographic requests without properly disabling specific background processing tasks. This can lead to internal kernel errors that disrupt operations and impact system availability.
Technical details
A race condition or improper state management exists in the Xilinx ZynqMP AES driver (drivers/crypto/xilinx/zynqmp-aes-gcm.c). Specifically, the function 'crypto_finalize_request' is called without disabling bottom halves (BH), which can trigger a kernel warning and subsequent instability or crash. An attacker with local access could potentially exploit this by submitting specific cryptographic requests that trigger the vulnerable code path in 'zynqmp_handle_aes_req'. The fix involves wrapping the finalization call with 'local_bh_disable()' and 'local_bh_enable()' to ensure atomic completion.
Affected products
- Linux Linux Kernel 5.7 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-04-17: advisory: NVD publication date
- 2024-03-26: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/03e6d4e948432a61b35783323b6ab2be071d2619
- https://git.kernel.org/stable/c/23bc89fdce71124cd2126fc919c7076e7cb489cf
- https://git.kernel.org/stable/c/8a01335aedc50a66d04dd39203c89f4bc8042596
- https://git.kernel.org/stable/c/9db89b1fb85557892e6681724b367287de5f9f20
- https://git.kernel.org/stable/c/a71f66bd5f7b9b35a8aaa49e29565eca66299399
- https://git.kernel.org/stable/c/a853450bf4c752e664abab0b2fad395b7ad7701c
- https://git.kernel.org/stable/c/dbf291d8ffffb70f48286176a15c6c54f0bb0743