CVE-2024-42229

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42229
In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key.

4.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/23e4099bdc3c8381992f9eb975c79196d6755210 Patch
https://git.kernel.org/stable/c/28c8d274848feba552e95c5c2a7e3cfe8f15c534 Patch
https://git.kernel.org/stable/c/71dd428615375e36523f4d4f7685ddd54113646d Patch
https://git.kernel.org/stable/c/89b9b6fa4463daf820e6a5ef65c3b0c2db239513
https://git.kernel.org/stable/c/9db8c299a521813630fcb4154298cb60c37f3133 Patch
https://git.kernel.org/stable/c/b502d4a08875ea2b4ea5d5b28dc7c991c8b90cfb Patch
https://git.kernel.org/stable/c/b716e9c3603ee95ed45e938fe47227d22cf3ec35
https://git.kernel.org/stable/c/f58679996a831754a356974376f248aa0af2eb8e Patch
https://git.kernel.org/stable/c/23e4099bdc3c8381992f9eb975c79196d6755210 Patch
https://git.kernel.org/stable/c/28c8d274848feba552e95c5c2a7e3cfe8f15c534 Patch
https://git.kernel.org/stable/c/71dd428615375e36523f4d4f7685ddd54113646d Patch
https://git.kernel.org/stable/c/9db8c299a521813630fcb4154298cb60c37f3133 Patch
https://git.kernel.org/stable/c/b502d4a08875ea2b4ea5d5b28dc7c991c8b90cfb Patch
https://git.kernel.org/stable/c/f58679996a831754a356974376f248aa0af2eb8e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 09:33

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/23e4099bdc3c8381992f9eb975c79196d6755210 - Patch () https://git.kernel.org/stable/c/23e4099bdc3c8381992f9eb975c79196d6755210 - Patch
References () https://git.kernel.org/stable/c/28c8d274848feba552e95c5c2a7e3cfe8f15c534 - Patch () https://git.kernel.org/stable/c/28c8d274848feba552e95c5c2a7e3cfe8f15c534 - Patch
References () https://git.kernel.org/stable/c/71dd428615375e36523f4d4f7685ddd54113646d - Patch () https://git.kernel.org/stable/c/71dd428615375e36523f4d4f7685ddd54113646d - Patch
References () https://git.kernel.org/stable/c/9db8c299a521813630fcb4154298cb60c37f3133 - Patch () https://git.kernel.org/stable/c/9db8c299a521813630fcb4154298cb60c37f3133 - Patch
References () https://git.kernel.org/stable/c/b502d4a08875ea2b4ea5d5b28dc7c991c8b90cfb - Patch () https://git.kernel.org/stable/c/b502d4a08875ea2b4ea5d5b28dc7c991c8b90cfb - Patch
References () https://git.kernel.org/stable/c/f58679996a831754a356974376f248aa0af2eb8e - Patch () https://git.kernel.org/stable/c/f58679996a831754a356974376f248aa0af2eb8e - Patch

08 Nov 2024, 16:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/89b9b6fa4463daf820e6a5ef65c3b0c2db239513 -
  • () https://git.kernel.org/stable/c/b716e9c3603ee95ed45e938fe47227d22cf3ec35 -

30 Jul 2024, 19:46

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.1
CWE NVD-CWE-Other
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/23e4099bdc3c8381992f9eb975c79196d6755210 - () https://git.kernel.org/stable/c/23e4099bdc3c8381992f9eb975c79196d6755210 - Patch
References () https://git.kernel.org/stable/c/28c8d274848feba552e95c5c2a7e3cfe8f15c534 - () https://git.kernel.org/stable/c/28c8d274848feba552e95c5c2a7e3cfe8f15c534 - Patch
References () https://git.kernel.org/stable/c/71dd428615375e36523f4d4f7685ddd54113646d - () https://git.kernel.org/stable/c/71dd428615375e36523f4d4f7685ddd54113646d - Patch
References () https://git.kernel.org/stable/c/9db8c299a521813630fcb4154298cb60c37f3133 - () https://git.kernel.org/stable/c/9db8c299a521813630fcb4154298cb60c37f3133 - Patch
References () https://git.kernel.org/stable/c/b502d4a08875ea2b4ea5d5b28dc7c991c8b90cfb - () https://git.kernel.org/stable/c/b502d4a08875ea2b4ea5d5b28dc7c991c8b90cfb - Patch
References () https://git.kernel.org/stable/c/f58679996a831754a356974376f248aa0af2eb8e - () https://git.kernel.org/stable/c/f58679996a831754a356974376f248aa0af2eb8e - Patch

30 Jul 2024, 13:32

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: crypto: aead,cipher - poner a cero el búfer de claves después de su uso IG 9.7.B para FIPS 140-3 especifica que las variables que contienen temporalmente información criptográfica deben ponerse a cero una vez que ya no sean necesarias. Logre esto usando kfree_SENSITIVE para los búfers que anteriormente contenían la clave privada.

30 Jul 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-30 08:15

Updated : 2024-11-21 09:33

NVD link : CVE-2024-42229

Mitre link : CVE-2024-42229

CVE.ORG link : CVE-2024-42229

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-Other