Integer Overflow in Linux Kernel KEYS Encrypted Key Handling

Executive Summary

This is a Linux kernel vulnerability where an integer overflow in encrypted_key_alloc() causes a buffer overflow. The function stores datablob_len in a u16, which can overflow if the computed length exceeds U16_MAX. This leads to a slab-out-of-bounds write when copying data into an undersized buffer.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's encrypted key handling. Detection requires checking kernel logs for KASAN reports of slab-out-of-bounds writes related to encrypted key operations. Monitor dmesg or system logs for errors like 'slab-out-of-bounds' or 'KASAN' warnings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering a buffer overflow in the Linux kernel's key management subsystem.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Linux kernel patches that fix the integer overflow in encrypted_key_alloc(). Update to a kernel version where check_add_overflow() is used to validate datablob_len and kzalloc_flex() handles allocations safely.

Useful 0 Not Useful 0