Junglewise Threat Intelligence

CVE-2024-38579: Linux Kernel Broadcom SPU crypto driver pointer arithmetic error

CVE-2024-38579 · Severity: medium · CVSS 5.5 · Published 2024-06-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Broadcom SPU (Secure Processing Unit) crypto driver. This component is responsible for hardware-accelerated cryptographic operations. An exploit could allow a local user to cause a system crash or instability, potentially leading to a denial of service.

Technical details

A vulnerability exists in the Broadcom SPU driver (drivers/crypto/bcm/spu2.c) within the Linux kernel due to incorrect pointer arithmetic in the spu2_dump_omd() function. Specifically, the pointer 'ptr' is incremented by 'ciph_key_len' instead of 'hash_iv_len' when processing hash initialization vectors. This logic error can cause the pointer to advance beyond the intended buffer boundaries during packet logging/dumping operations. An attacker with local access could trigger this condition to cause a kernel oops or denial of service. The issue has been patched across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.11 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3

Timeline

  • 2024-06-19: disclosed
  • 2024-06-19: advisory

References

Related threats