crypto: virtio/akcipher - Fix stack overflow on memcpy
sizeof(struct virtio_crypto_akcipher_session_para) is less than
sizeof(struct virtio_crypto_op_ctrl_req::u), copying more bytes from
stack variable leads stack overflow. Clang reports this issue by
commands:
make -j CC=clang-14 mrproper >/dev/null 2>&1
make -j O=/tmp/crypto-build CC=clang-14 allmodconfig >/dev/null 2>&1
make -j O=/tmp/crypto-build W=1 CC=clang-14 drivers/crypto/virtio/
virtio_crypto_akcipher_algs.o
Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-3842-1 | linux-5.10 security update |
Debian DSA |
DSA-5658-1 | linux security update |
Debian DSA |
DSA-5681-1 | linux security update |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Thu, 27 Feb 2025 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Debian
Debian debian Linux Linux Linux linux Kernel |
|
| Weaknesses | CWE-787 | |
| CPEs | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:* |
|
| Vendors & Products |
Debian
Debian debian Linux Linux Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Fri, 22 Nov 2024 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 05 Nov 2024 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 05 Nov 2024 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 12 Sep 2024 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 11 Sep 2024 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2025-05-04T08:55:44.222Z
Reserved: 2024-02-19T14:20:24.169Z
Link: CVE-2024-26753
Updated: 2024-08-02T00:14:13.229Z
Status : Analyzed
Published: 2024-04-03T17:15:51.990
Modified: 2025-02-27T21:59:09.400
Link: CVE-2024-26753
OpenCVE Enrichment
No data.
Debian DLA
Debian DSA