Executive brief
A vulnerability in the Linux kernel's handling of digital security certificates could allow a system crash or memory corruption. The issue occurs when the system processes specially crafted X.509 certificates with unusually large data fields, such as serial numbers or issuer names. This could potentially be used by an attacker to disrupt operations or gain unauthorized access to systems relying on these certificates for secure communication.
Technical details
An integer overflow vulnerability exists in the 'asymmetric_key_generate_id' function within the Linux kernel's crypto subsystem. The root cause is a lack of overflow validation when calculating the total size required for an 'asymmetric_key_id' structure plus its associated binary blob lengths (val_1 and val_2). An attacker providing a malicious X.509 certificate with arbitrarily large ASN.1 INTEGER serial numbers or issuer names can trigger this overflow, resulting in an undersized memory allocation via kmalloc and a subsequent buffer overflow during the memcpy operation. The fix introduces 'check_add_overflow()' to validate these calculations before allocation.
Affected products
- Linux Linux Kernel 7901c1a8effb to 6.12.y
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and earlier
Timeline
- 2025-10-13: other: Patch authored
- 2025-12-24: disclosed: CVE published
- 2025-12-18: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c
- https://git.kernel.org/stable/c/60a7be5ee74408147e439164ac067e418ca74bb4
- https://git.kernel.org/stable/c/6af753ac5205115e6c310c8c4236c01b59a1c44f
- https://git.kernel.org/stable/c/b7090a5c153105b9fd221a5a81459ee8cd5babd6
- https://git.kernel.org/stable/c/c13c6e9de91d7f1dd7df756b1fa5a1f968839d76
- https://git.kernel.org/stable/c/c73be4f51eed98fa0c7c189db8f279e1c86bfbf7
- https://git.kernel.org/stable/c/df0845cf447ae1556c3440b8b155de0926cbaa56