[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 18 Jan 2017 00:55:40 -0500
From: <cve-assign@...re.org>
To: <vdronov@...hat.com>
CC: <cve-assign@...re.org>, <oss-security@...ts.openwall.com>
Subject: Re: CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> Algorithms not compatible with mcryptd could be spawned by mcryptd with a direct
> crypto_alloc_tfm invocation using a "mcryptd(alg)" name construct. This causes
> mcryptd to crash the kernel if an arbitrary "alg" is incompatible and not intended
> to be used with mcryptd.
>
> This could be a potential attack to crash the kernel by user program using AF_ALG
> to request an invalid algorithm such as mcryptd(md5).
>
> Initial discussion:
>
> https://marc.info/?l=dm-devel&m=148063708010538&w=2
>
> Suggested Patch:
>
> http://marc.info/?l=linux-crypto-vger&m=148096718218312&w=2
>
> Red Hat Product Security Bugzilla:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1404200
>
> Upstream patch:
>
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48a992727d82cb7db076fa15d372178743b1f4cd
>> crypto: mcryptd - Check mcryptd algorithm compatibility
Use CVE-2016-10147.
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJYfwJ3AAoJEHb/MwWLVhi2Ru0P/0ttpZUnBzHshdCjrphHtTYc
QcPtCH6szWvN6LXp/80AukRKXcqrdZ5RHYOf9RmUjqrc5BTXJ9+U6DebtdaHWZFP
qdvTKylZqgElgbhVxAQaBH1ToSSc1UTHdyPD21kYojtPbTBEE0amho1nLWx2zizR
t1VQTgnvjHn2M2cl0b7khoR2f+gOfbb1b8wo5nzZltlp/brcQ99sqU0x0uI8mbTl
20WzwhLwoONX6kb4MQj56N0GEEFuwU8JRg6hZ0wcPWcnWMUvtHsc6i1ks5CPrNOJ
/Zm889icKhKu/bO2jhtYHlqjuIWiM6DSnnbgcGInke7Zp+hHTbTSqbPia9etMsTt
nfH4x7MerG9HZyz4NDN8t6Obcblw9So+dtWmp1RIV/jAiNmAx1jl3ubdzFMnxfIH
fJNCMLaQu+dNKeaHuV9GEJP/Yz30rTcW66QfeAgaLS3CuuiO+sx/VkIJiRywCZKz
0CQri5/+BIHGxqWeLknNZzrQcEHASQ34W9vVAIkQYKBFRmgHno7oH2LDVPukbwEa
KjNTWSuvF+6oqA/TwSZ+T+Tou7l4yPZXF+BIVsO+6Wl7i6LSEVMcHJijK2dbw2wI
AVj2lX9Y52yZnPo7PBpWZZlPYMVTiTitp7tRplJPGvCh7Q/P7EJFRcoc/aQrwViX
/baDXLh1PIHdI/0LfLKK
=qPZQ
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
