{"timestamp":"2024-07-17T15:06:02.450614Z","id":"CVE-2024-27061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4136212ab18eb3dce6efb6e18108765c36708f71","lessThan":"dc60b25540c82fc4baa95d1458ae96ead21859e0","versionType":"git","status":"affected"},{"version":"4136212ab18eb3dce6efb6e18108765c36708f71","lessThan":"51a7d338c212e0640b1aca52ba6590d5bea49879","versionType":"git","status":"affected"},{"version":"4136212ab18eb3dce6efb6e18108765c36708f71","lessThan":"183420038444547c149a0fc5f58e792c2752860c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","versionType":"semver","status":"unaffected"},{"version":"6.6.24","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.7.12","lessThanOrEqual":"6.7.*","versionType":"semver","status":"unaffected"},{"version":"6.8","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416

CWE-476

OR
          *cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 from (excluding) 6.7.12
          *cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6 from (excluding) 6.6.24
          *cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*

CVE: https://git.kernel.org/stable/c/183420038444547c149a0fc5f58e792c2752860c Types: Patch

CVE: https://git.kernel.org/stable/c/51a7d338c212e0640b1aca52ba6590d5bea49879 Types: Patch

CVE: https://git.kernel.org/stable/c/dc60b25540c82fc4baa95d1458ae96ead21859e0 Types: Patch

kernel.org: https://git.kernel.org/stable/c/183420038444547c149a0fc5f58e792c2752860c Types: Patch

kernel.org: https://git.kernel.org/stable/c/51a7d338c212e0640b1aca52ba6590d5bea49879 Types: Patch

kernel.org: https://git.kernel.org/stable/c/dc60b25540c82fc4baa95d1458ae96ead21859e0 Types: Patch

https://git.kernel.org/stable/c/183420038444547c149a0fc5f58e792c2752860c

https://git.kernel.org/stable/c/51a7d338c212e0640b1aca52ba6590d5bea49879

https://git.kernel.org/stable/c/dc60b25540c82fc4baa95d1458ae96ead21859e0

In the Linux kernel, the following vulnerability has been resolved:

crypto: sun8i-ce - Fix use after free in unprepare

sun8i_ce_cipher_unprepare should be called before
crypto_finalize_skcipher_request, because client callbacks may
immediately free memory, that isn't needed anymore. But it will be
used by unprepare after free. Before removing prepare/unprepare
callbacks it was handled by crypto engine in crypto_finalize_request.

Usually that results in a pointer dereference problem during a in
crypto selftest.
 Unable to handle kernel NULL pointer dereference at
                                      virtual address 0000000000000030
 Mem abort info:
   ESR = 0x0000000096000004
   EC = 0x25: DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
   FSC = 0x04: level 0 translation fault
 Data abort info:
   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
 user pgtable: 4k pages, 48-bit VAs, pgdp=000000004716d000
 [0000000000000030] pgd=0000000000000000, p4d=0000000000000000
 Internal error: Oops: 0000000096000004 [#1] SMP

This problem is detected by KASAN as well.
 ==================================================================
 BUG: KASAN: slab-use-after-free in sun8i_ce_cipher_do_one+0x6e8/0xf80 [sun8i_ce]
 Read of size 8 at addr ffff00000dcdc040 by task 1c15000.crypto-/373

 Hardware name: Pine64 PinePhone (1.2) (DT)
 Call trace:
  dump_backtrace+0x9c/0x128
  show_stack+0x20/0x38
  dump_stack_lvl+0x48/0x60
  print_report+0xf8/0x5d8
  kasan_report+0x90/0xd0
  __asan_load8+0x9c/0xc0
  sun8i_ce_cipher_do_one+0x6e8/0xf80 [sun8i_ce]
  crypto_pump_work+0x354/0x620 [crypto_engine]
  kthread_worker_fn+0x244/0x498
  kthread+0x168/0x178
  ret_from_fork+0x10/0x20

 Allocated by task 379:
  kasan_save_stack+0x3c/0x68
  kasan_set_track+0x2c/0x40
  kasan_save_alloc_info+0x24/0x38
  __kasan_kmalloc+0xd4/0xd8
  __kmalloc+0x74/0x1d0
  alg_test_skcipher+0x90/0x1f0
  alg_test+0x24c/0x830
  cryptomgr_test+0x38/0x60
  kthrea

kernel.org https://git.kernel.org/stable/c/183420038444547c149a0fc5f58e792c2752860c [No types assigned]

kernel.org https://git.kernel.org/stable/c/51a7d338c212e0640b1aca52ba6590d5bea49879 [No types assigned]

kernel.org https://git.kernel.org/stable/c/dc60b25540c82fc4baa95d1458ae96ead21859e0 [No types assigned]