In the Linux kernel, the following vulnerability has been resolved:
crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
The commit referenced in the Fixes tag removed the 'break' from the else branch in qcom_rng_read(), causing an infinite loop whenever 'max' is not a multiple of WORD_SZ. This can be reproduced e.g. by running:
kcapi-rng -b 67 >/dev/null
There are many ways to fix this without adding back the 'break', but they all seem more awkward than simply adding it back, so do just that.
Tested on a machine with Qualcomm Amberwing processor.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-kvmsmallUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade dlm-kmp-rtUpgrade kernel-rt-develUpgrade kernel-64kb-extraUpgrade kernel-rt-livepatchUpgrade dtb-amlogicUpgrade kernel-obs-buildUpgrade dtb-exynosUpgrade kernel-devel-rtUpgrade dtb-qcomUpgrade kernel-defaultUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-azure-livepatch-develUpgrade kernel-rtUpgrade dtb-sprdUpgrade kernel-syms-azureUpgrade kernel-debug-vdsoUpgrade kernel-develUpgrade kernel-azure-develUpgrade dtb-mediatekUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade dtb-rockchipUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade dtb-armUpgrade dtb-caviumUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-docs-htmlUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-azure-extraUpgrade kernel-debugUpgrade kernel-azure-vdsoUpgrade dtb-lgUpgrade dtb-appleUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-renesasUpgrade kernel-debug-livepatch-develUpgrade dtb-alteraUpgrade kernel-source-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-freescaleUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-azure-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-source-azureUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-defaultUpgrade dtb-socionextUpgrade dtb-amazonUpgrade kernel-default-develUpgrade kernel-rt_debugUpgrade kernel-rt-optionalUpgrade kernel-64kb-livepatch-develUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade dtb-marvellUpgrade kernel-64kbUpgrade kernel-obs-qaUpgrade kernel-debug-develUpgrade kernel-symsUpgrade dtb-broadcomUpgrade dlm-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-default-extraUpgrade kernel-syms-rtUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade dtb-apmUpgrade kernel-kvmsmall-devel | Aug 9, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade linux-realtimeUpgrade linux-azure-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-fipsUpgrade linux-awsUpgrade linux-gcpUpgrade linux-aws-5.15Upgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-riscv-5.15Upgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-nvidiaUpgrade linux-aws-5.4Upgrade linux-gkeopUpgrade linux-oracleUpgrade linux-azure-fipsUpgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-gkeUpgrade linux-ibmUpgrade linux-gcp-5.4Upgrade linux-aws-fipsUpgrade linux-hwe-5.15Upgrade linux-azure-5.15Upgrade linux-hwe-5.4Upgrade linuxUpgrade linux-azureUpgrade linux-oracle-5.15Upgrade linux-lowlatencyUpgrade linux-ibm-5.4 | Nov 19, 2024 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub