CVE-2022-50731: In the Linux kernel, the following vulnerability has been resolved: crypto: akcipher - default implementation for setting a private key Changes from v1: *…

PriorityP424medium5.5

EPSS

0.22%

12.5th percentile

In the Linux kernel, the following vulnerability has been resolved:

crypto: akcipher - default implementation for setting a private key

Changes from v1:
* removed the default implementation from set_pub_key: it is assumed that
an implementation must always have this callback defined as there are
no use case for an algorithm, which doesn't need a public key

Many akcipher implementations (like ECDSA) support only signature
verifications, so they don't have all callbacks defined.

Commit 78a0324f4a53 ("crypto: akcipher - default implementations for
request callbacks") introduced default callbacks for sign/verify
operations, which just return an error code.

However, these are not enough, because before calling sign the caller would
likely call set_priv_key first on the instantiated transform (as the
in-kernel testmgr does). This function does not have a default stub, so the
kernel crashes, when trying to set a private key on an akcipher, which
doesn't support signature generation.

I've noticed this, when trying to add a KAT vector for ECDSA signature to
the testmgr.

With this patch the testmgr returns an error in dmesg (as it should)
instead of crashing the kernel NULL ptr dereference.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.3-1 (bookworm)	linux 6.0.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= 78a0324f4a5328088fea9426cfe1d1851276c475 < 95c4e20adc3ea00d1594a2a05d9b187ed12ffa8e	95c4e20adc3ea00d1594a2a05d9b187ed12ffa8e
linux	linux	>= 78a0324f4a5328088fea9426cfe1d1851276c475 < a1354bdd191d533211b7cb723aa76a66f516f197	a1354bdd191d533211b7cb723aa76a66f516f197
linux	linux	>= 78a0324f4a5328088fea9426cfe1d1851276c475 < 779a9930f3e152c82699feb389a0e6d6644e747e	779a9930f3e152c82699feb389a0e6d6644e747e
linux	linux	>= 78a0324f4a5328088fea9426cfe1d1851276c475 < 85bc736a18b872f54912e8bb70682d11770aece0	85bc736a18b872f54912e8bb70682d11770aece0
linux	linux	>= 78a0324f4a5328088fea9426cfe1d1851276c475 < f9058178597059d6307efe96a7916600f8ede08c	f9058178597059d6307efe96a7916600f8ede08c
linux	linux	>= 78a0324f4a5328088fea9426cfe1d1851276c475 < bc155c6c188c2f0c5749993b1405673d25a80389	bc155c6c188c2f0c5749993b1405673d25a80389
linux	linux_kernel	>= 0 < 5.10.158-1	5.10.158-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 5.11.0 < 5.15.75	5.15.75
linux	linux_kernel	>= 5.16.0 < 5.19.17	5.19.17
linux	linux_kernel	>= 5.2.0 < 5.4.220	5.4.220
linux	linux_kernel	>= 5.20.0 < 6.0.3	6.0.3
linux	linux_kernel	>= 5.5.0 < 5.10.150	5.10.150

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.