| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025110904-CVE-2025-40109-23f5@gregkh> Date: Sun, 9 Nov 2025 13:36:04 +0900 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-40109: crypto: rng - Ensure set_ent is always present From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since only drbg provides it. The Linux kernel CVE team has assigned CVE-2025-40109 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10 with commit 77ebdabe8de7c02f43c6de3357f79ff96f9f0579 and fixed in 5.10.246 with commit 15d6f42da1bb527629d8e1067b1302d58dec9166 Issue introduced in 5.10 with commit 77ebdabe8de7c02f43c6de3357f79ff96f9f0579 and fixed in 5.15.195 with commit bd903c25b652c331831226cdf56c8179d18e43f4 Issue introduced in 5.10 with commit 77ebdabe8de7c02f43c6de3357f79ff96f9f0579 and fixed in 6.1.156 with commit 17acbcd44fe8dc17dc1072375e76df2d52da6ac8 Issue introduced in 5.10 with commit 77ebdabe8de7c02f43c6de3357f79ff96f9f0579 and fixed in 6.6.111 with commit ab172f4f42626549b02bada05f09e3f2b0cc26ec Issue introduced in 5.10 with commit 77ebdabe8de7c02f43c6de3357f79ff96f9f0579 and fixed in 6.12.52 with commit c5c703b50e91dd4748769f4c5ab50d9ad60be370 Issue introduced in 5.10 with commit 77ebdabe8de7c02f43c6de3357f79ff96f9f0579 and fixed in 6.16.12 with commit e247a7d138e514a40edda7c4d72c8bd49bb2cad3 Issue introduced in 5.10 with commit 77ebdabe8de7c02f43c6de3357f79ff96f9f0579 and fixed in 6.17.2 with commit 915cb75983bc5e8b80f8a2f25a4af463f7b18c14 Issue introduced in 5.10 with commit 77ebdabe8de7c02f43c6de3357f79ff96f9f0579 and fixed in 6.18-rc1 with commit c0d36727bf39bb16ef0a67ed608e279535ebf0da Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-40109 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: crypto/rng.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/15d6f42da1bb527629d8e1067b1302d58dec9166 https://git.kernel.org/stable/c/bd903c25b652c331831226cdf56c8179d18e43f4 https://git.kernel.org/stable/c/17acbcd44fe8dc17dc1072375e76df2d52da6ac8 https://git.kernel.org/stable/c/ab172f4f42626549b02bada05f09e3f2b0cc26ec https://git.kernel.org/stable/c/c5c703b50e91dd4748769f4c5ab50d9ad60be370 https://git.kernel.org/stable/c/e247a7d138e514a40edda7c4d72c8bd49bb2cad3 https://git.kernel.org/stable/c/915cb75983bc5e8b80f8a2f25a4af463f7b18c14 https://git.kernel.org/stable/c/c0d36727bf39bb16ef0a67ed608e279535ebf0da
Powered by blists - more mailing lists