In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak
For some sev ioctl interfaces, input may be passed that is less than or equal to SEVFWBLOBMAXSIZE, but larger than the data that PSP firmware returns. In this case, kmalloc will allocate memory that is the size of the input rather than the size of the data. Since PSP firmware doesn't fully overwrite the buffer, the sev ioctl interfaces with the issue may return uninitialized slab memory.
Currently, all of the ioctl interfaces in the ccp driver are safe, but to prevent future problems, change all ioctl interfaces that allocate memory with kmalloc to use kzalloc and memset the data buffer to zero in sevioctldoplatformstatus.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@caa395aa16e7c9193fd7fa6cde462dd8229d4953",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c",
"function": "sev_ioctl_do_platform_status"
},
"id": "CVE-2022-50226-033c6e9c",
"signature_type": "Function",
"digest": {
"function_hash": "29045129380362370672239759847540482052",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2a920daa780956b987c14b9f23de7c3c8915bf2",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c"
},
"id": "CVE-2022-50226-2d013a1f",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"254633989091954608971325079090141846214",
"46965874489853885222615410279740880638",
"335886289009647582596340111815069815803",
"61171761910883585166608580891997228605",
"283193021842896322969655899870755463415",
"193292302266929595802362716838960772327",
"334568994961894103320811356675402411351",
"273221305563343858738638198535634456757",
"335950801609941481619830335809870883653",
"158406604092673177027304054084227849988",
"35240290085237633577789924387086862036",
"236626656070624472959462126926272583639",
"149848008483000665921415769046890522532",
"148017483782068085220680406350852885035",
"180187483509191241839257050492974912898",
"194881052659548528070550730100998901578",
"326324845318655901607768905101992616710",
"304971032401066366896350187648674567049",
"151414364959894537223331695919772590115",
"277323470859619655677835137588555277661"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e11fb0a3a39bb42da35fa662c46ce7391f277436",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c",
"function": "sev_ioctl_do_platform_status"
},
"id": "CVE-2022-50226-460d30a4",
"signature_type": "Function",
"digest": {
"function_hash": "29045129380362370672239759847540482052",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c5300f6f5e18b11c02a92f136e69b98fddba15e",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c",
"function": "sev_ioctl_do_platform_status"
},
"id": "CVE-2022-50226-620593a1",
"signature_type": "Function",
"digest": {
"function_hash": "29045129380362370672239759847540482052",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e11fb0a3a39bb42da35fa662c46ce7391f277436",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c"
},
"id": "CVE-2022-50226-71ceaa66",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"254633989091954608971325079090141846214",
"46965874489853885222615410279740880638",
"335886289009647582596340111815069815803",
"61171761910883585166608580891997228605",
"283193021842896322969655899870755463415",
"193292302266929595802362716838960772327",
"334568994961894103320811356675402411351",
"273221305563343858738638198535634456757",
"335950801609941481619830335809870883653",
"158406604092673177027304054084227849988",
"35240290085237633577789924387086862036",
"236626656070624472959462126926272583639",
"149848008483000665921415769046890522532",
"148017483782068085220680406350852885035",
"180187483509191241839257050492974912898",
"194881052659548528070550730100998901578",
"326324845318655901607768905101992616710",
"304971032401066366896350187648674567049",
"151414364959894537223331695919772590115",
"277323470859619655677835137588555277661"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c5300f6f5e18b11c02a92f136e69b98fddba15e",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c"
},
"id": "CVE-2022-50226-7d4a32aa",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"254633989091954608971325079090141846214",
"46965874489853885222615410279740880638",
"335886289009647582596340111815069815803",
"61171761910883585166608580891997228605",
"283193021842896322969655899870755463415",
"193292302266929595802362716838960772327",
"334568994961894103320811356675402411351",
"273221305563343858738638198535634456757",
"335950801609941481619830335809870883653",
"158406604092673177027304054084227849988",
"35240290085237633577789924387086862036",
"236626656070624472959462126926272583639",
"149848008483000665921415769046890522532",
"148017483782068085220680406350852885035",
"180187483509191241839257050492974912898",
"194881052659548528070550730100998901578",
"326324845318655901607768905101992616710",
"304971032401066366896350187648674567049",
"151414364959894537223331695919772590115",
"277323470859619655677835137588555277661"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13dc15a3f5fd7f884e4bfa8c011a0ae868df12ae",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c",
"function": "sev_ioctl_do_platform_status"
},
"id": "CVE-2022-50226-a1d348bb",
"signature_type": "Function",
"digest": {
"function_hash": "29045129380362370672239759847540482052",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13dc15a3f5fd7f884e4bfa8c011a0ae868df12ae",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c"
},
"id": "CVE-2022-50226-a53c578e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"254633989091954608971325079090141846214",
"46965874489853885222615410279740880638",
"335886289009647582596340111815069815803",
"61171761910883585166608580891997228605",
"283193021842896322969655899870755463415",
"193292302266929595802362716838960772327",
"334568994961894103320811356675402411351",
"273221305563343858738638198535634456757",
"335950801609941481619830335809870883653",
"158406604092673177027304054084227849988",
"35240290085237633577789924387086862036",
"236626656070624472959462126926272583639",
"149848008483000665921415769046890522532",
"148017483782068085220680406350852885035",
"180187483509191241839257050492974912898",
"194881052659548528070550730100998901578",
"326324845318655901607768905101992616710",
"304971032401066366896350187648674567049",
"151414364959894537223331695919772590115",
"277323470859619655677835137588555277661"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@caa395aa16e7c9193fd7fa6cde462dd8229d4953",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c"
},
"id": "CVE-2022-50226-c5f5a550",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"254633989091954608971325079090141846214",
"46965874489853885222615410279740880638",
"335886289009647582596340111815069815803",
"61171761910883585166608580891997228605",
"283193021842896322969655899870755463415",
"193292302266929595802362716838960772327",
"334568994961894103320811356675402411351",
"273221305563343858738638198535634456757",
"335950801609941481619830335809870883653",
"158406604092673177027304054084227849988",
"35240290085237633577789924387086862036",
"236626656070624472959462126926272583639",
"149848008483000665921415769046890522532",
"148017483782068085220680406350852885035",
"180187483509191241839257050492974912898",
"194881052659548528070550730100998901578",
"326324845318655901607768905101992616710",
"304971032401066366896350187648674567049",
"151414364959894537223331695919772590115",
"277323470859619655677835137588555277661"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2a920daa780956b987c14b9f23de7c3c8915bf2",
"target": {
"file": "drivers/crypto/ccp/sev-dev.c",
"function": "sev_ioctl_do_platform_status"
},
"id": "CVE-2022-50226-e1510b14",
"signature_type": "Function",
"digest": {
"function_hash": "29045129380362370672239759847540482052",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
}
]