In the Linux kernel, the following vulnerability has been resolved:
crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
The commit referenced in the Fixes tag removed the 'break' from the else branch in qcom_rng_read(), causing an infinite loop whenever 'max' is not a multiple of WORD_SZ. This can be reproduced e.g. by running:
kcapi-rng -b 67 >/dev/null
There are many ways to fix this without adding back the 'break', but they all seem more awkward than simply adding it back, so do just that.
Tested on a machine with Qualcomm Amberwing processor.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade gfs2-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-alteraUpgrade dtb-apmUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-defaultUpgrade kernel-source-azureUpgrade dtb-broadcomUpgrade dlm-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-syms-rtUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-develUpgrade kernel-rt_debugUpgrade kernel-64kb-develUpgrade dtb-allwinnerUpgrade dtb-hisiliconUpgrade gfs2-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-symsUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-debugUpgrade kernel-azure-vdsoUpgrade dtb-lgUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-appleUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-freescaleUpgrade kernel-debug-livepatch-develUpgrade dtb-renesasUpgrade kernel-default-extraUpgrade kernel-64kb-optionalUpgrade dtb-marvellUpgrade dtb-amdUpgrade dtb-socionextUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-debug-develUpgrade kernel-default-baseUpgrade kernel-obs-qaUpgrade reiserfs-kmp-defaultUpgrade dtb-amazonUpgrade kernel-docs-htmlUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-livepatchUpgrade dtb-exynosUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-macrosUpgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-defaultUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade kernel-docsUpgrade kernel-devel-rtUpgrade dtb-qcomUpgrade dtb-amlogicUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade dlm-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-default-optionalUpgrade dtb-armUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade gfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade dlm-kmp-rtUpgrade kernel-rt-develUpgrade kernel-sourceUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade kernel-azureUpgrade kernel-develUpgrade kernel-default-base-rebuildUpgrade dtb-sprdUpgrade kernel-devel-azure | Aug 9, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade linux-gkeopUpgrade linux-azure-fipsUpgrade linux-hwe-5.4Upgrade linux-hwe-5.15Upgrade linux-raspiUpgrade linux-azureUpgrade linux-oracle-5.15Upgrade linux-azure-5.15Upgrade linux-lowlatencyUpgrade linuxUpgrade linux-gkeUpgrade linux-gcp-5.4Upgrade linux-aws-fipsUpgrade linux-nvidiaUpgrade linux-oracle-5.4Upgrade linux-ibm-5.4Upgrade linux-aws-5.4Upgrade linux-ibmUpgrade linux-oracleUpgrade linux-riscv-5.15Upgrade linux-raspi-5.4Upgrade linux-gcp-fipsUpgrade linux-gcpUpgrade linux-gcp-5.15Upgrade linux-bluefieldUpgrade linux-aws-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-kvmUpgrade linux-fipsUpgrade linux-realtimeUpgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iotg | Nov 19, 2024 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub