CVE-2022-49094

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net/tls: fix slab-out-of-bounds bug in decrypt_internal The memory size of tls_ctx->rx.iv for AES128-CCM is 12 setting in tls_set_sw_offload(). The return value of crypto_aead_ivsize() for "ccm(aes)" is 16. So memcpy() require 16 bytes from 12 bytes memory space will trigger slab-out-of-bounds bug as following: ================================================================== BUG: KASAN: slab-out-of-bounds in decrypt_internal+0x385/0xc40 [tls] Read of size 16 at addr ffff888114e84e60 by task tls/10911 Call Trace: <TASK> du...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= f295b3ae9f5927e084bd5decdff82390e3471801 < 2b7d14c105dd8f6412eda5a91e1e6154653731e3, >= f295b3ae9f5927e084bd5decdff82390e3471801 < 589154d0f18945f41d138a5b4e49e518d294474b, >= f295b3ae9f5927e084bd5decdff82390e3471801 < 6e2f1b033b17dedda51d465861b69e58317d6343, >= f295b3ae9f5927e084bd5decdff82390e3471801 < 29be1816cbab9a0dc6243120939fd10a92753756, >= f295b3ae9f5927e084bd5decdff82390e3471801 < 2304660ab6c425df64d95301b601424c6a50f28b, >= f295b3ae9f5927e084bd5decdff82390e3471801 < 9381fe8c849cfbe50245ac01fc077554f6eaa0e2, >= 5.2, >= 5.2 < 5.4.189, >= 5.5 < 5.10.111, >= 5.11 < 5.15.34, >= 5.16 < 5.16.20, >= 5.17 < 5.17.3, 5.18

Fixed versions

5.4.189, 5.10.111, 5.15.34, 5.16.20, 5.17.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-125