In the Linux kernel, the following vulnerability has been resolved:
crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
The commit referenced in the Fixes tag removed the 'break' from the else branch in qcom_rng_read(), causing an infinite loop whenever 'max' is not a multiple of WORD_SZ. This can be reproduced e.g. by running:
kcapi-rng -b 67 >/dev/null
There are many ways to fix this without adding back the 'break', but they all seem more awkward than simply adding it back, so do just that.
Tested on a machine with Qualcomm Amberwing processor.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade kernel-default-livepatchUpgrade dtb-apmUpgrade kselftests-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-vdsoUpgrade ocfs2-kmp-rtUpgrade dtb-freescaleUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-develUpgrade kernel-azure-optionalUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-hisiliconUpgrade reiserfs-kmp-defaultUpgrade kernel-source-rtUpgrade kernel-rt_debugUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-default-develUpgrade dtb-lgUpgrade dtb-renesasUpgrade kernel-symsUpgrade kselftests-kmp-azureUpgrade kernel-debugUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-rt-livepatch-develUpgrade kernel-default-baseUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-optionalUpgrade dtb-amazonUpgrade kernel-azure-extraUpgrade kernel-syms-rtUpgrade dtb-broadcomUpgrade kernel-zfcpdumpUpgrade dtb-appleUpgrade kernel-debug-livepatch-develUpgrade dtb-socionextUpgrade reiserfs-kmp-rtUpgrade kernel-64kbUpgrade dtb-amdUpgrade dtb-marvellUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-azureUpgrade kernel-64kb-livepatch-develUpgrade dtb-alteraUpgrade kernel-default-vdsoUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade dtb-qcomUpgrade kernel-docsUpgrade kernel-devel-rtUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-default-optionalUpgrade kernel-debug-vdsoUpgrade dtb-xilinxUpgrade dlm-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-azureUpgrade cluster-md-kmp-rtUpgrade kernel-defaultUpgrade kernel-sourceUpgrade dtb-armUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade kernel-macrosUpgrade dtb-mediatekUpgrade dtb-amlogicUpgrade kernel-obs-buildUpgrade cluster-md-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-rt-develUpgrade dtb-caviumUpgrade kernel-rt-livepatchUpgrade kernel-64kb-extraUpgrade kernel-azure-develUpgrade kselftests-kmp-defaultUpgrade kernel-develUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-devel-azureUpgrade dtb-nvidiaUpgrade dlm-kmp-rtUpgrade dtb-exynosUpgrade dtb-rockchipUpgrade ocfs2-kmp-default | Aug 9, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade linux-oracleUpgrade linux-azure-fipsUpgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linux-hwe-5.15Upgrade linux-oracle-5.15Upgrade linux-hwe-5.4Upgrade linux-azureUpgrade linux-gkeopUpgrade linux-ibm-5.4Upgrade linux-lowlatencyUpgrade linux-gcp-5.4Upgrade linux-nvidiaUpgrade linux-gkeUpgrade linux-ibmUpgrade linux-oracle-5.4Upgrade linuxUpgrade linux-aws-5.4Upgrade linux-raspiUpgrade linux-gcpUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-5.15Upgrade linux-awsUpgrade linux-bluefieldUpgrade linux-aws-5.15Upgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-intel-iotg-5.15Upgrade linux-realtimeUpgrade linux-fipsUpgrade linux-azure-5.4Upgrade linux-riscv-5.15Upgrade linux-intel-iotgUpgrade linux-raspi-5.4 | Nov 19, 2024 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub