Linux Kernel Null Pointer Dereference Vulnerability in Crypto Library's mpi_cmp_ui Function

A null pointer dereference vulnerability has been identified in the Linux kernel's crypto library, specifically within the mpi_cmp_ui function. This issue arises during NVMe over TCP authentication when a controller specifies an 8192-bit Diffie-Hellman group and sends a properly sized, but zeroed, Diffie-Hellman value. The function dh_is_pubkey_valid() passes a '1' to mpi_cmp_ui(), which should ideally be '0' for a zeroed value. This discrepancy leads to the dereferencing of a null pointer, causing a kernel oops.

Impact

Exploitation of this vulnerability leads to a kernel oops, causing a crash or instability in the system.

Reproduction

To reproduce this vulnerability, initiate an NVMe over TCP authentication process. During this process, specify an 8192-bit Diffie-Hellman group and send a Diffie-Hellman value that is correctly sized but zeroed. The mpi_cmp_ui function will incorrectly process this value, leading to a null pointer dereference.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched.