CVE-2022-48630

Summary

In the Linux kernel, the following vulnerability has been resolved:

crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ

The commit referenced in the Fixes tag removed the 'break' from the else branch in qcom_rng_read(), causing an infinite loop whenever 'max' is not a multiple of WORD_SZ. This can be reproduced e.g. by running:

kcapi-rng -b 67 >/dev/null

There are many ways to fix this without adding back the 'break', but they all seem more awkward than simply adding it back, so do just that.

Tested on a machine with Qualcomm Amberwing processor.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxa8e32bbb96c25b7ab29b1894dcd45e0b3b08fd9d < 71a89789552b7faf3ef27969b9bc783fa0df3550affected
LinuxLinux184f7bd08ce56f003530fc19f160d54e75bf5c9d < 8be06f62b426801dba43ddf8893952a0e62ab6aeaffected
LinuxLinux0f9b7b8df17525e464294c916acc8194ce38446b < 233a3cc60e7a8fe0be8cf9934ae7b67ba25a866caffected
LinuxLinuxab9337c7cb6f875b6286440b1adfbeeef2b2b2bd < 8a06f25f5941c145773204f2f7abef95b4ffb8ceaffected
LinuxLinuxa680b1832ced3b5fa7c93484248fd221ea0d614b < 05d4d17475d8d094c519bb51658bc47899c175e3affected
LinuxLinuxa680b1832ced3b5fa7c93484248fd221ea0d614b < 16287397ec5c08aa58db6acf7dbc55470d78087daffected
LinuxLinux485995cbc98a4f77cfd4f8ed4dd7ff8ab262964daffected
LinuxLinux4.19.236 < 4.19.245affected
LinuxLinux5.4.187 < 5.4.196affected
LinuxLinux5.10.108 < 5.10.118affected
LinuxLinux5.15.31 < 5.15.42affected
LinuxLinux5.16.17 < 5.17affected
LinuxLinux5.17affected
LinuxLinux0 < 5.17unaffected
LinuxLinux4.19.245 <= 4.19.*unaffected
LinuxLinux5.4.196 <= 5.4.*unaffected
LinuxLinux5.10.118 <= 5.10.*unaffected
LinuxLinux5.15.42 <= 5.15.*unaffected
LinuxLinux5.17.10 <= 5.17.*unaffected
LinuxLinux5.18 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References