161 lines
9.2 KiB
JSON
161 lines
9.2 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-63805",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-19T07:54:57.013Z",
|
|
"datePublished": "2026-07-19T12:02:09.669Z",
|
|
"dateUpdated": "2026-08-17T04:51:11.095Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-17T04:51:11.095Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: nx - fix nx_crypto_ctx_exit argument\n\nnx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...)\nbut crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *.\n\nFix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx\ncall.\n\nThis fixes the following oops:\n\n BUG: Unable to handle kernel data access at 0xc0403effffffffc8\n Faulting instruction address: 0xc000000000396cb4\n Oops: Kernel access of bad area, sig: 11 [#15]\n Call Trace:\n nx_crypto_ctx_shash_exit+0x24/0x60\n crypto_shash_exit_tfm+0x28/0x40\n crypto_destroy_tfm+0x98/0x140\n crypto_exit_ahash_using_shash+0x20/0x40\n crypto_destroy_tfm+0x98/0x140\n hash_release+0x1c/0x30\n alg_sock_destruct+0x38/0x60\n __sk_destruct+0x48/0x2b0\n af_alg_release+0x58/0xb0\n __sock_release+0x68/0x150\n sock_close+0x20/0x40\n __fput+0x110/0x3a0\n sys_close+0x48/0xa0\n system_call_exception+0x140/0x2d0\n system_call_common+0xf4/0x258\n\n.. which came from hardlink(1) opportunistically using AF_ALG.\n\nThe same problem exists with nx_crypto_ctx_skcipher_exit getting a context\nit wasn't expecting, but apparently nobody hit that for years."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - Exploitation requires a local syscall path (socket/AF_ALG bind, then close via sys_close) through the crypto userspace API; the NX driver is not reachable from remote network packet handling.\nAC:L - On affected IBM Power pSeries systems with NX hardware and the nx-crypto driver loaded, an attacker can deterministically trigger the bug by opening an AF_ALG hash socket, binding a SHA algorithm that selects the nx driver, and closing the socket.\nPR:L - No special privileges are required beyond a normal local user account; AF_ALG sockets are available to unprivileged users and remain reachable from user namespaces without init-namespace root.\nUI:N - No victim interaction is needed beyond the attacker running their own program that opens and closes an AF_ALG crypto socket (as demonstrated by hardlink(1) opportunistically using AF_ALG).\nS:U - Impact is confined to kernel memory within the same security authority; this is a local kernel memory-corruption/crash issue, not a VM escape or cross-security-boundary bypass.\nC:H - The type confusion causes reads through a miscomputed context pointer before the fault, and erroneous kfree_sensitive() on attacker-influenced kernel pointers can corrupt heap metadata and enable further information disclosure.\nI:H - The same type confusion leads to kfree_sensitive() on a wrong address and NULL pointer writes through a misaligned nx_crypto_ctx, giving exploitable heap corruption and arbitrary kernel write primitives.\nA:H - The bug reliably causes a kernel oops (SIGSEGV in kernel mode) during crypto context teardown, crashing the calling context and potentially the entire system under panic-on-oops policy."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/crypto/nx/nx.c",
|
|
"drivers/crypto/nx/nx.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "bfd9efddf990d152dc9912fdca520c5e1e19e1e2",
|
|
"lessThan": "8d8507a457667f23477a15496b91908a5b5b7cf3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bfd9efddf990d152dc9912fdca520c5e1e19e1e2",
|
|
"lessThan": "833033e6e55acf11304ff7bbbdf18351d139c281",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "bfd9efddf990d152dc9912fdca520c5e1e19e1e2",
|
|
"lessThan": "4e67f504ee9ded15e256b64f4fde150e917381d7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/crypto/nx/nx.c",
|
|
"drivers/crypto/nx/nx.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.5",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.5",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.38",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.3",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.5",
|
|
"versionEndExcluding": "6.18.38"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.5",
|
|
"versionEndExcluding": "7.1.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.5",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8d8507a457667f23477a15496b91908a5b5b7cf3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/833033e6e55acf11304ff7bbbdf18351d139c281"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4e67f504ee9ded15e256b64f4fde150e917381d7"
|
|
}
|
|
],
|
|
"title": "crypto: nx - fix nx_crypto_ctx_exit argument",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |