Vulnerability-Lookup

GHSA-C982-MG4H-7C8X

Vulnerability from github – Published: 2025-02-27 03:34 – Updated: 2025-10-23 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y

With vmalloc stack addresses enabled (CONFIG_VMAP_STACK=y) DCP trusted keys can crash during en- and decryption of the blob encryption key via the DCP crypto driver. This is caused by improperly using sg_init_one() with vmalloc'd stack buffers (plain_key_blob).

Fix this by always using kmalloc() for buffers we give to the DCP crypto driver.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-58008"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-27T03:15:11Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y\n\nWith vmalloc stack addresses enabled (CONFIG_VMAP_STACK=y) DCP trusted\nkeys can crash during en- and decryption of the blob encryption key via\nthe DCP crypto driver. This is caused by improperly using sg_init_one()\nwith vmalloc\u0027d stack buffers (plain_key_blob).\n\nFix this by always using kmalloc() for buffers we give to the DCP crypto\ndriver.",
  "id": "GHSA-c982-mg4h-7c8x",
  "modified": "2025-10-23T15:30:23Z",
  "published": "2025-02-27T03:34:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58008"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3192f1c54dddb9b5820bf5e8677809949d8e9c66"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3355594de46fb1cba663f12b9644b664b8a609f4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e8d9fab39d1f87b52932646b2f1e7877aa3fc0f4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-58008 (GCVE-0-2024-58008)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-08-05 11:47

Title

KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y

Summary

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y With vmalloc stack addresses enabled (CONFIG_VMAP_STACK=y) DCP trusted keys can crash during en- and decryption of the blob encryption key via the DCP crypto driver. This is caused by improperly using sg_init_one() with vmalloc'd stack buffers (plain_key_blob). Fix this by always using kmalloc() for buffers we give to the DCP crypto driver.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

3 references

URL	Tags
https://git.kernel.org/stable/c/3192f1c54dddb9b58…
https://git.kernel.org/stable/c/3355594de46fb1cba…
https://git.kernel.org/stable/c/e8d9fab39d1f87b52…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb , < 3192f1c54dddb9b5820bf5e8677809949d8e9c66 (git) Affected: 0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb , < 3355594de46fb1cba663f12b9644b664b8a609f4 (git) Affected: 0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb , < e8d9fab39d1f87b52932646b2f1e7877aa3fc0f4 (git) Affected: 9e3b266afcfe4294e84496f50f006f029d3100db (git) Affected: 6.10.7 , < 6.11 (semver)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.14 , ≤ 6.12.* (semver) Unaffected: 6.13.3 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/keys/trusted-keys/trusted_dcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3192f1c54dddb9b5820bf5e8677809949d8e9c66",
              "status": "affected",
              "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb",
              "versionType": "git"
            },
            {
              "lessThan": "3355594de46fb1cba663f12b9644b664b8a609f4",
              "status": "affected",
              "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb",
              "versionType": "git"
            },
            {
              "lessThan": "e8d9fab39d1f87b52932646b2f1e7877aa3fc0f4",
              "status": "affected",
              "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9e3b266afcfe4294e84496f50f006f029d3100db",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/keys/trusted-keys/trusted_dcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y\n\nWith vmalloc stack addresses enabled (CONFIG_VMAP_STACK=y) DCP trusted\nkeys can crash during en- and decryption of the blob encryption key via\nthe DCP crypto driver. This is caused by improperly using sg_init_one()\nwith vmalloc\u0027d stack buffers (plain_key_blob).\n\nFix this by always using kmalloc() for buffers we give to the DCP crypto\ndriver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable paths are entered only through the `add_key(2)`/`keyctl` syscall interface (`trusted_instantiate()` \u2192 `trusted_dcp_seal()`/`trusted_dcp_unseal()`), which requires a local account or shell on the i.MX device. There is no network or adjacent-network protocol that reaches the DCP trusted-key code.\nAC:L - On an affected build (`CONFIG_VMAP_STACK=y`, which is `default y`, plus `CONFIG_TRUSTED_KEYS_DCP=y`, `default y` on i.MX defconfigs) the stack buffer is always a vmalloc address, so `sg_init_one()` unconditionally builds a scatterlist with an out-of-range `struct page *` on every seal and unseal \u2014 no race, timing window, or victim state is involved. The attacker can repeat `add_key()` from many threads to sweep different kernel-stack addresses and therefore different bogus PFNs, so success does not depend on conditions outside their control.\nPR:L - `add_key(2)` only needs write permission on a keyring the caller already owns (`@u`/`@s`), and `trusted_instantiate()` performs no `capable()` check on the DCP path \u2014 the sole `CAP_SYS_ADMIN` gate in trusted-keys is in TPM1 `pcrlock()`, which is unreachable here. Any unprivileged local user, including a sandboxed application, can create or load a DCP trusted key.\nUI:N - The attacker triggers the defect entirely on their own by issuing `keyctl add trusted k \"new 32\" @u` or `\"load \u003chexblob\u003e\"`; no other user must mount a filesystem, open a file, or take any action.\nS:U - The bogus scatterlist page and the resulting wild read/write stay within the kernel\u0027s own address space and are reached through an ordinary syscall, so the vulnerable and impacted components share one security authority. No VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The seal path makes the mxs-dcp driver `memcpy()` 16 bytes from `sg_virt()` of a `struct page *` that lies outside `mem_map`, so with `CONFIG_HIGHMEM=y` the out-of-bounds `PageHighMem()` flag read can send `kmap_atomic()` at an arbitrary physical frame and the driver reads kernel memory it was never meant to touch. This wild-pointer read pairs with the wild write below to form a memory-corruption primitive that can be leveraged to disclose kernel memory, so High is the appropriate rating.\nI:H - The unseal path is worse than a read: `sg_pcopy_from_buffer()` writes 16 bytes of DCP-decrypted output through the out-of-bounds page into memory that does not belong to the buffer, an out-of-bounds write whose target is influenced by the attacker\u0027s choice of thread stack and whose contents derive from the attacker-supplied blob ciphertext. Out-of-bounds kernel writes are rated High because they can be groomed into control-flow hijacking.\nA:H - The commit explicitly states DCP trusted keys \"can crash during en- and decryption\"; dereferencing a `struct page *` past `mem_map` yields a NULL or unmapped source address for the `memcpy` or a fixmap entry pointing at nonexistent physical memory, producing a kernel oops or external abort. An unprivileged user can invoke this repeatedly via `add_key()` for a reliable denial of service on the device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:24.494Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3192f1c54dddb9b5820bf5e8677809949d8e9c66"
        },
        {
          "url": "https://git.kernel.org/stable/c/3355594de46fb1cba663f12b9644b664b8a609f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8d9fab39d1f87b52932646b2f1e7877aa3fc0f4"
        }
      ],
      "title": "KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58008",
    "datePublished": "2025-02-27T02:12:04.100Z",
    "dateReserved": "2025-02-27T02:10:48.227Z",
    "dateUpdated": "2026-08-05T11:47:24.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-C982-MG4H-7C8X

CVE-2024-58008 (GCVE-0-2024-58008)

Tags

Sightings

Nomenclature

Related by attack behaviour