Executive brief
A vulnerability was identified in the Linux kernel's Broadcom SPU (Secure Processing Unit) crypto driver. This component is responsible for hardware-accelerated cryptographic operations. An exploit could allow a local user to cause a system crash or instability, potentially leading to a denial of service.
Technical details
A vulnerability exists in the Broadcom SPU driver (drivers/crypto/bcm/spu2.c) within the Linux kernel due to incorrect pointer arithmetic in the spu2_dump_omd() function. Specifically, the pointer 'ptr' is incremented by 'ciph_key_len' instead of 'hash_iv_len' when processing hash initialization vectors. This logic error can cause the pointer to advance beyond the intended buffer boundaries during packet logging/dumping operations. An attacker with local access could trigger this condition to cause a kernel oops or denial of service. The issue has been patched across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.11 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3
Timeline
- 2024-06-19: disclosed
- 2024-06-19: advisory
References
- https://git.kernel.org/stable/c/2b3460cbf454c6b03d7429e9ffc4fe09322eb1a9
- https://git.kernel.org/stable/c/3b7a40740f04e2f27114dfd6225c5e721dda9d57
- https://git.kernel.org/stable/c/49833a8da6407e7e9b532cc4054fdbcaf78f5fdd
- https://git.kernel.org/stable/c/c0082ee420639a97e40cae66778b02b341b005e5
- https://git.kernel.org/stable/c/c256b616067bfd6d274c679c06986b78d2402434
- https://git.kernel.org/stable/c/c69a1e4b419c2c466dd8c5602bdebadc353973dd
- https://git.kernel.org/stable/c/d0f14ae223c2421b334c1f1a9e48f1e809aee3a0