In the Linux kernel, the following vulnerability has been resolved:
crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
The commit referenced in the Fixes tag removed the 'break' from the else branch in qcomrngread(), causing an infinite loop whenever 'max' is not a multiple of WORD_SZ. This can be reproduced e.g. by running:
kcapi-rng -b 67 >/dev/null
There are many ways to fix this without adding back the 'break', but they all seem more awkward than simply adding it back, so do just that.
Tested on a machine with Qualcomm Amberwing processor.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48630.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 544.0,
"function_hash": "18479009961544884226998988517199430992"
},
"id": "CVE-2022-48630-06daef39",
"target": {
"function": "qcom_rng_read",
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16287397ec5c08aa58db6acf7dbc55470d78087d"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 544.0,
"function_hash": "18479009961544884226998988517199430992"
},
"id": "CVE-2022-48630-4e6d78c9",
"target": {
"function": "qcom_rng_read",
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a06f25f5941c145773204f2f7abef95b4ffb8ce"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 544.0,
"function_hash": "18479009961544884226998988517199430992"
},
"id": "CVE-2022-48630-62436903",
"target": {
"function": "qcom_rng_read",
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05d4d17475d8d094c519bb51658bc47899c175e3"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-647c0179",
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71a89789552b7faf3ef27969b9bc783fa0df3550"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 544.0,
"function_hash": "18479009961544884226998988517199430992"
},
"id": "CVE-2022-48630-6550967f",
"target": {
"function": "qcom_rng_read",
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8be06f62b426801dba43ddf8893952a0e62ab6ae"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-6f08674c",
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05d4d17475d8d094c519bb51658bc47899c175e3"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-b25cf458",
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16287397ec5c08aa58db6acf7dbc55470d78087d"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-b267122d",
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a06f25f5941c145773204f2f7abef95b4ffb8ce"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-d4b314b9",
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8be06f62b426801dba43ddf8893952a0e62ab6ae"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 544.0,
"function_hash": "18479009961544884226998988517199430992"
},
"id": "CVE-2022-48630-da89a7c8",
"target": {
"function": "qcom_rng_read",
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@233a3cc60e7a8fe0be8cf9934ae7b67ba25a866c"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 544.0,
"function_hash": "18479009961544884226998988517199430992"
},
"id": "CVE-2022-48630-defd7fc2",
"target": {
"function": "qcom_rng_read",
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71a89789552b7faf3ef27969b9bc783fa0df3550"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-f5bad5d4",
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@233a3cc60e7a8fe0be8cf9934ae7b67ba25a866c"
}
]