In the Linux kernel, the following vulnerability has been resolved:
dm-crypt: don't modify the data when using authenticated encryption
It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio.
This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time.
[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/
[
{
"signature_type": "Function",
"id": "CVE-2024-26763-20208883",
"target": {
"file": "drivers/md/dm-crypt.c",
"function": "kcryptd_crypt_write_convert"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50c70240097ce41fe6bce6478b80478281e4d0f7",
"signature_version": "v1",
"digest": {
"function_hash": "115742048059046194501070996616960681120",
"length": 1018.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-26763-208ff2ed",
"target": {
"file": "drivers/md/dm-crypt.c",
"function": "kcryptd_crypt_write_convert"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90",
"signature_version": "v1",
"digest": {
"function_hash": "115742048059046194501070996616960681120",
"length": 1018.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-26763-4e17a2b2",
"target": {
"file": "drivers/md/dm-crypt.c",
"function": "kcryptd_crypt_write_convert"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dccbb93538fe89a86c6de31d4b1c8c560848eaa",
"signature_version": "v1",
"digest": {
"function_hash": "299923542724282831937490413638277720391",
"length": 703.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-26763-5e1b796c",
"target": {
"file": "drivers/md/dm-crypt.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ba01a365980755732972523600a961c4266b75",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56907746795424945641527976968835289170",
"102869550818470360220296806828429688825",
"192611764773261229280668202818117803334"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-26763-64c6afe4",
"target": {
"file": "drivers/md/dm-crypt.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43a202bd552976497474ae144942e32cc5f34d7e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56907746795424945641527976968835289170",
"102869550818470360220296806828429688825",
"298257381025636813272123634251643713332"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-26763-79f5b32e",
"target": {
"file": "drivers/md/dm-crypt.c",
"function": "kcryptd_crypt_write_convert"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ba01a365980755732972523600a961c4266b75",
"signature_version": "v1",
"digest": {
"function_hash": "115742048059046194501070996616960681120",
"length": 1018.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-26763-939df3be",
"target": {
"file": "drivers/md/dm-crypt.c",
"function": "kcryptd_crypt_write_convert"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a4371db68a31076afbe56ecce34fbbe6c80c529",
"signature_version": "v1",
"digest": {
"function_hash": "115742048059046194501070996616960681120",
"length": 1018.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-26763-93d18e8f",
"target": {
"file": "drivers/md/dm-crypt.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dccbb93538fe89a86c6de31d4b1c8c560848eaa",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56907746795424945641527976968835289170",
"102869550818470360220296806828429688825",
"298257381025636813272123634251643713332"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-26763-9ff4b871",
"target": {
"file": "drivers/md/dm-crypt.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50c70240097ce41fe6bce6478b80478281e4d0f7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56907746795424945641527976968835289170",
"102869550818470360220296806828429688825",
"192611764773261229280668202818117803334"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-26763-a204dd57",
"target": {
"file": "drivers/md/dm-crypt.c",
"function": "kcryptd_crypt_write_convert"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e08c2a8d27e989f0f5b0888792643027d7e691e6",
"signature_version": "v1",
"digest": {
"function_hash": "115742048059046194501070996616960681120",
"length": 1018.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-26763-ba80a784",
"target": {
"file": "drivers/md/dm-crypt.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56907746795424945641527976968835289170",
"102869550818470360220296806828429688825",
"192611764773261229280668202818117803334"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-26763-bc1922b2",
"target": {
"file": "drivers/md/dm-crypt.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9e3763a505e50ba3bd22846f2a8db99429fb857",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56907746795424945641527976968835289170",
"102869550818470360220296806828429688825",
"192611764773261229280668202818117803334"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-26763-d664aa08",
"target": {
"file": "drivers/md/dm-crypt.c",
"function": "kcryptd_crypt_write_convert"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43a202bd552976497474ae144942e32cc5f34d7e",
"signature_version": "v1",
"digest": {
"function_hash": "299923542724282831937490413638277720391",
"length": 703.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-26763-eef711e5",
"target": {
"file": "drivers/md/dm-crypt.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e08c2a8d27e989f0f5b0888792643027d7e691e6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56907746795424945641527976968835289170",
"102869550818470360220296806828429688825",
"192611764773261229280668202818117803334"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-26763-fc136806",
"target": {
"file": "drivers/md/dm-crypt.c",
"function": "kcryptd_crypt_write_convert"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9e3763a505e50ba3bd22846f2a8db99429fb857",
"signature_version": "v1",
"digest": {
"function_hash": "115742048059046194501070996616960681120",
"length": 1018.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-26763-fc6b5e2b",
"target": {
"file": "drivers/md/dm-crypt.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a4371db68a31076afbe56ecce34fbbe6c80c529",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"56907746795424945641527976968835289170",
"102869550818470360220296806828429688825",
"192611764773261229280668202818117803334"
]
},
"deprecated": false
}
]