In the Linux kernel, the following vulnerability has been resolved:
crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ
The commit referenced in the Fixes tag removed the 'break' from the else branch in qcomrngread(), causing an infinite loop whenever 'max' is not a multiple of WORD_SZ. This can be reproduced e.g. by running:
kcapi-rng -b 67 >/dev/null
There are many ways to fix this without adding back the 'break', but they all seem more awkward than simply adding it back, so do just that.
Tested on a machine with Qualcomm Amberwing processor.
[
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c",
"function": "qcom_rng_read"
},
"digest": {
"function_hash": "18479009961544884226998988517199430992",
"length": 544.0
},
"id": "CVE-2022-48630-06daef39",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16287397ec5c08aa58db6acf7dbc55470d78087d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c",
"function": "qcom_rng_read"
},
"digest": {
"function_hash": "18479009961544884226998988517199430992",
"length": 544.0
},
"id": "CVE-2022-48630-4e6d78c9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a06f25f5941c145773204f2f7abef95b4ffb8ce",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c",
"function": "qcom_rng_read"
},
"digest": {
"function_hash": "18479009961544884226998988517199430992",
"length": 544.0
},
"id": "CVE-2022-48630-62436903",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05d4d17475d8d094c519bb51658bc47899c175e3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-647c0179",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71a89789552b7faf3ef27969b9bc783fa0df3550",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c",
"function": "qcom_rng_read"
},
"digest": {
"function_hash": "18479009961544884226998988517199430992",
"length": 544.0
},
"id": "CVE-2022-48630-6550967f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8be06f62b426801dba43ddf8893952a0e62ab6ae",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-6f08674c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05d4d17475d8d094c519bb51658bc47899c175e3",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-b25cf458",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16287397ec5c08aa58db6acf7dbc55470d78087d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-b267122d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a06f25f5941c145773204f2f7abef95b4ffb8ce",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-d4b314b9",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8be06f62b426801dba43ddf8893952a0e62ab6ae",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c",
"function": "qcom_rng_read"
},
"digest": {
"function_hash": "18479009961544884226998988517199430992",
"length": 544.0
},
"id": "CVE-2022-48630-da89a7c8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@233a3cc60e7a8fe0be8cf9934ae7b67ba25a866c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c",
"function": "qcom_rng_read"
},
"digest": {
"function_hash": "18479009961544884226998988517199430992",
"length": 544.0
},
"id": "CVE-2022-48630-defd7fc2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71a89789552b7faf3ef27969b9bc783fa0df3550",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/crypto/qcom-rng.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"122802971784755531238843432191132821762",
"111450495339411996641902331534928506828",
"248675817343875552633972743949584145851",
"24704440542672298120803862159930644396"
]
},
"id": "CVE-2022-48630-f5bad5d4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@233a3cc60e7a8fe0be8cf9934ae7b67ba25a866c",
"signature_version": "v1"
}
]