Executive Summary

This vulnerability exists in the Linux kernel's crypto subsystem, specifically in the atmel-sha204a driver. It involves a potential use-after-free (UAF) and memory leak during the device removal process. The issue arises because the hardware random number generator (hwrng) was not properly unregistered, allowing new read calls to occur while the device was being removed. Additionally, the Atmel I2C workqueue was not flushed before teardown, which could lead to a queued callback running on a freed device, causing a UAF. There was also an early return that prevented sysfs entries from being removed and the hwrng private data from being freed, resulting in a memory leak.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to use-after-free conditions and memory leaks in the Linux kernel, which may cause system instability or crashes. Exploiting the use-after-free could potentially allow an attacker to execute arbitrary code or cause denial of service by triggering kernel faults. Memory leaks could degrade system performance over time.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by updating the Linux kernel to include fixes in the atmel-sha204a crypto driver. Immediate mitigation involves applying the updated Linux kernel version that contains the fix.

Specifically, the fix unregisters the hardware random number generator (hwrng) to prevent new read calls, flushes the Atmel I2C workqueue before device teardown to prevent use-after-free (UAF), and ensures sysfs entries are removed and memory is freed to prevent leaks.

Useful 0 Not Useful 0