| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024060804-CVE-2024-36967-b73d@gregkh> Date: Sat, 8 Jun 2024 14:53:04 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-36967: KEYS: trusted: Fix memory leak in tpm2_key_encode() Description =========== In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2_key_encode() 'scratch' is never freed. Fix this by calling kfree() in the success, and in the error case. The Linux kernel CVE team has assigned CVE-2024-36967 to this issue. Affected and fixed versions =========================== Issue introduced in 5.13 with commit f2219745250f and fixed in 5.15.160 with commit 1e6914fa8e77 Issue introduced in 5.13 with commit f2219745250f and fixed in 6.1.92 with commit 5d91238b590b Issue introduced in 5.13 with commit f2219745250f and fixed in 6.6.32 with commit e62835264d03 Issue introduced in 5.13 with commit f2219745250f and fixed in 6.8.11 with commit 189c768932d4 Issue introduced in 5.13 with commit f2219745250f and fixed in 6.9.2 with commit cf26a92f560e Issue introduced in 5.13 with commit f2219745250f and fixed in 6.10-rc1 with commit ffcaa2172cc1 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-36967 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: security/keys/trusted-keys/trusted_tpm2.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1e6914fa8e7798bcf3ce4a5b96ea4ac1d5571cdf https://git.kernel.org/stable/c/5d91238b590bd883c86ba7707c5c9096469c08b7 https://git.kernel.org/stable/c/e62835264d0352be6086975f18fdfed2b5520b13 https://git.kernel.org/stable/c/189c768932d435045b1fae12bf63e53866f06a28 https://git.kernel.org/stable/c/cf26a92f560eed5d6ddc3d441cc645950cbabc56 https://git.kernel.org/stable/c/ffcaa2172cc1a85ddb8b783de96d38ca8855e248
Powered by blists - more mailing lists