ecryptfs: Fix buffer size for tag 66 packet
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: Fix buffer size for tag 66 packet The 'TAG 66 Packet Format' description is missing the cipher code and checksum fields that are packed into the message packet. As a result, the buffer allocated for the packet is 3 bytes too small and write_tag_66_packet() will write up to 3 bytes past the end of the buffer. Fix this by increasing the size of the allocation so the whole packet will always fit in the buffer. This fixes the below kasan slab-out-of-bounds bug: BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0 Write of size 1 at addr ffff88800afbb2a5 by task touch/181 CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014 Call Trace: dump_stack_lvl+0x4c/0x70 print_report+0xc5/0x610 ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 ? kasan_complete_mode_report_info+0x44/0x210 ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 kasan_report+0xc2/0x110 ? ecryptfs_generate_key_packet_set+0x7d6/0xde0 __asan_store1+0x62/0x80 ecryptfs_generate_key_packet_set+0x7d6/0xde0 ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10 ? __alloc_pages+0x2e2/0x540 ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d] ? dentry_open+0x8f/0xd0 ecryptfs_write_metadata+0x30a/0x550 ? __pfx_ecryptfs_write_metadata+0x10/0x10 ? ecryptfs_get_lower_file+0x6b/0x190 ecry
CVE-2024-38578
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-38578
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "1c125b9287e58f364d82174efb167414b92b11f1",
"versionType": "git"
},
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "235b85981051cd68fc215fd32a81c6f116bfc4df",
"versionType": "git"
},
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "edbfc42ab080e78c6907d40a42c9d10b69e445c1",
"versionType": "git"
},
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "12db25a54ce6bb22b0af28010fff53ef9cb3fe93",
"versionType": "git"
},
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "0d0f8ba042af16519f1ef7dd10463a33b21b677c",
"versionType": "git"
},
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "2ed750b7ae1b5dc72896d7dd114c419afd3d1910",
"versionType": "git"
},
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "a20f09452e2f58f761d11ad7b96b5c894c91030e",
"versionType": "git"
},
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "f6008487f1eeb8693f8d2a36a89c87d9122ddf74",
"versionType": "git"
},
{
"status": "affected",
"version": "dddfa461fc8951f9b5f951c13565b6cac678635a",
"lessThan": "85a6a1aff08ec9f5b929d345d066e2830e8818e5",
"versionType": "git"
}
],
"programFiles": [
"fs/ecryptfs/keystore.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.21",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.316",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.278",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.219",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.161",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.93",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.33",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.8.12",
"versionType": "semver",
"lessThanOrEqual": "6.8.*"
},
{
"status": "unaffected",
"version": "6.9.3",
"versionType": "semver",
"lessThanOrEqual": "6.9.*"
},
{
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/ecryptfs/keystore.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-38578
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #26609 · Revision 1
- Added to Heist Feed
- Publisher date