Linux Kernel Hisilicon QM Crypto Module Stack Overflow Vulnerability

A stack overflow vulnerability has been identified in the Linux kernel's Hisilicon QM crypto module. The issue arises because the 'val buffer' variable, which is used for QoS configuration, is only 32 bytes long. This length is insufficient, as the maximum QoS configuration buffer can be 256 bytes. The vulnerability is further exacerbated by the 'sscanf' function, which does not validate the length of the destination memory, allowing for potential stack overflow exploitation.

Impact

Exploitation of this vulnerability can lead to a stack overflow, which may be used to execute arbitrary code or cause a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by sending a QoS configuration that exceeds 32 bytes, but less than 256 bytes, to the Hisilicon QM crypto module. The 'sscanf' function will not properly check the buffer length, causing a stack overflow.

Remediation

Users can upgrade to the patched version of the Linux kernel available in the Linux kernel stable tree.