Stack-based buffer overflow in Linux kernel crypto virtio driver

1) Stack-based buffer overflow

EUVDB-ID: #VU91300

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26753

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to stack overflow within the virtio_crypto_dataq_akcipher_callback() and virtio_crypto_alg_akcipher_init_session() functions in drivers/crypto/virtio/virtio_crypto_akcipher_algs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/37077ed16c7793e21b005979d33f8a61565b7e86
http://git.kernel.org/stable/c/62f361bfea60c6afc3df09c1ad4152e6507f6f47
http://git.kernel.org/stable/c/b0365460e945e1117b47cf7329d86de752daff63
http://git.kernel.org/stable/c/ef1e47d50324e232d2da484fe55a54274eeb9bc1
http://git.kernel.org/stable/c/c0ec2a712daf133d9996a8a1b7ee2d4996080363

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.