In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: qce – fix CCM AAD buffer underallocation<\/p>\n
The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen()
\ncan be smaller than the length later programmed into the DMA
\nscatterlist.<\/p>\n
The allocation size is currently calculated as:<\/p>\n
ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN<\/p>\n
while the DMA length is set to:<\/p>\n
ALIGN(assoclen + adata_header_len, 16)<\/p>\n
Since ALIGN() does not distribute over addition, the allocation
\ncan be smaller than the DMA length. For example, when
\nassoclen = 32 and adata_header_len = 2:<\/p>\n
allocation = ALIGN(32, 16) + 6 = 38
\n DMA length = ALIGN(32 + 2, 16) = 48<\/p>\n
As a result, the QCE hardware can read beyond the allocated
\nbuffer while computing the CBC-MAC over the associated data.
\nThe extra bytes are folded into the authentication tag,
\nresulting in an incorrect tag and causing CCM self-test
\nfailures such as:<\/p>\n
alg: aead: ccm-aes-qce encryption test failed (wrong result)
\n on test vector 8<\/p>\n
Fix the allocation by adding the maximum possible AAD header
\nlength before alignment:<\/p>\n
ALIGN(assoclen + MAX_CCM_ADATA_HEADER_LEN, 16)<\/p>\n
This guarantees that the allocated buffer is large enough
\nfor the fully padded AAD data for all supported header sizes.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: qce – fix CCM AAD buffer underallocation<\/p>\n
The AAD buffer allocated in qce_aead_ccm_prepare_buf_assoclen()
\ncan be smaller th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17336","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}