CVE-2022-48629

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: qcom-rng - ensure buffer for generate is completely filled

The generate function in struct rng_alg expects that the destination

buffer is completely filled if the function returns 0. qcom_rng_read()

can run into a situation where the buffer is partially filled with

randomness and the remaining part of the buffer is zeroed since

qcom_rng_generate() doesn't check the return value. This issue can

be reproduced by running the following from libkcapi:

kcapi-rng -b 9000000 > OUTFILE

The generated OUTFILE will have three huge sections that contain all

zeros, and this is caused by the code where the test

'val & PRNG_STATUS_DATA_AVAIL' fails.

Let's fix this issue by ensuring that qcom_rng_read() always returns

with a full buffer if the function returns success. Let's also have

qcom_rng_generate() return the correct value.

Here's some statistics from the ent project

(https://www.fourmilab.ch/random/) that shows

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References