Kernel Vulnerability in Linux Product by Linux Foundation Affecting AES-S390 Driver

CVE-2023-53599

What is CVE-2023-53599?

A vulnerability in the Linux kernel's af_alg subsystem, specifically related to the gcm-aes-s390 driver, has been identified. The issue arises from a failure to properly initialize the scatterlist array within the af_alg_alloc_areq() function. This can lead to kernel pointer dereferences when processing empty ciphertexts, causing the kernel to fault. The vulnerability exposes systems to potential crashes or instability during encryption operations. Proper initialization of the areq->first_rsgl structure is crucial to prevent malfunction during execution.

References