Executive brief
The Linux kernel's zcrypt cryptographic device driver contains a flaw in how it parses cryptographic protocol messages (EP11 CPRB) used for secure communication with hardware security modules. The vulnerable code used unsafe memory overlays instead of proper validation, allowing an attacker to craft malformed messages that could corrupt memory or bypass domain isolation controls, potentially affecting systems using IBM mainframe cryptographic hardware.
Technical details
The vulnerability exists in the zcrypt_msgtype6_send_ep11_cprb() function in drivers/s390/crypto/zcrypt_msgtype6.c, which uses fragile struct overlays (pld_hdr) to access and modify the domain field in EP11 CPRB (Command/Response Block) payloads without proper ASN.1 validation. The vulnerable code makes assumptions about fixed payload structure and employs error-prone length format detection logic that fails to validate bounds at each parsing step. An attacker with access to send EP11 CPRB messages can craft specially-formed ASN.1-encoded payloads that bypass validation, potentially corrupting memory or bypassing domain isolation controls. The fix replaces unsafe struct overlays with explicit ASN.1 parsing that validates each field (payload tag/length, function tag/length/value, domain tag/length/value) with proper bounds checking at every step, and adds an asn1_int_encode() helper function for safe integer encoding.
Affected products
- Linux Linux kernel 7.1 and later
Timeline
- 2026-08-26: disclosed
- 2026-08-05: patched: Patch committed upstream; backported to stable branches starting 7.1