The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AFALG-based skcipher interface (CONFIGCRYPTOUSERAPISKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipherwalk API. Both the generic implementation (crypto/salsa20generic.c) and x86 implementation (arch/x86/crypto/salsa20glue.c) of Salsa20 were vulnerable.
[
{
"signature_version": "v1",
"target": {
"file": "arch/x86/crypto/salsa20_glue.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ecaaab5649781c5a0effdaf298a925063020500e",
"signature_type": "Line",
"id": "CVE-2017-17805-197622a2",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"192505501067329174377481036567113042917",
"31660517346566687460519131174035080385",
"239671024670022197579686663127024993426",
"95656673283277894929565602629482625680",
"71935924562026326087976828271295262885",
"322614552036091377633240231940021648878",
"52156454553055898393803520746706491315",
"238811560834759912087322909010186118288",
"250913874926372864539974592304796016717"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/crypto/salsa20_glue.c",
"function": "encrypt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ecaaab5649781c5a0effdaf298a925063020500e",
"signature_type": "Function",
"id": "CVE-2017-17805-33f2312f",
"deprecated": false,
"digest": {
"function_hash": "93370486639974375890774415414967227755",
"length": 829.0
}
},
{
"signature_version": "v1",
"target": {
"file": "crypto/salsa20_generic.c",
"function": "encrypt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ecaaab5649781c5a0effdaf298a925063020500e",
"signature_type": "Function",
"id": "CVE-2017-17805-4248743f",
"deprecated": false,
"digest": {
"function_hash": "93370486639974375890774415414967227755",
"length": 829.0
}
},
{
"signature_version": "v1",
"target": {
"file": "crypto/salsa20_generic.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@ecaaab5649781c5a0effdaf298a925063020500e",
"signature_type": "Line",
"id": "CVE-2017-17805-a1124ebb",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"192505501067329174377481036567113042917",
"31660517346566687460519131174035080385",
"237800581411178097979031540769744273820",
"310585104608610065462707721385328277661",
"83939680225640729362580221493840073192",
"141439557860308890675324223719123117208",
"309153899177331608743791811662436076320",
"229469828090179037354189375645285568667",
"243958665018805074212576630183782479567"
]
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-17805.json"
[
{
"signature_version": "v1",
"target": {
"file": "crypto/salsa20_generic.c"
},
"source": "https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500e",
"signature_type": "Line",
"id": "CVE-2017-17805-3ded8668",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"192505501067329174377481036567113042917",
"31660517346566687460519131174035080385",
"237800581411178097979031540769744273820",
"310585104608610065462707721385328277661",
"83939680225640729362580221493840073192",
"141439557860308890675324223719123117208",
"309153899177331608743791811662436076320",
"229469828090179037354189375645285568667",
"243958665018805074212576630183782479567"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "crypto/salsa20_generic.c",
"function": "encrypt"
},
"source": "https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500e",
"signature_type": "Function",
"id": "CVE-2017-17805-95ad4c91",
"deprecated": false,
"digest": {
"function_hash": "93370486639974375890774415414967227755",
"length": 829.0
}
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/crypto/salsa20_glue.c"
},
"source": "https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500e",
"signature_type": "Line",
"id": "CVE-2017-17805-d8eda057",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"192505501067329174377481036567113042917",
"31660517346566687460519131174035080385",
"239671024670022197579686663127024993426",
"95656673283277894929565602629482625680",
"71935924562026326087976828271295262885",
"322614552036091377633240231940021648878",
"52156454553055898393803520746706491315",
"238811560834759912087322909010186118288",
"250913874926372864539974592304796016717"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "arch/x86/crypto/salsa20_glue.c",
"function": "encrypt"
},
"source": "https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500e",
"signature_type": "Function",
"id": "CVE-2017-17805-e91fbdb5",
"deprecated": false,
"digest": {
"function_hash": "93370486639974375890774415414967227755",
"length": 829.0
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-17805.json"