Linux Kernel AF_ALG RX Scatterlist Extraction Vulnerability

A vulnerability in the Linux kernel's AF_ALG crypto interface has been addressed. The issue allowed the RX scatterlist extraction to exceed the available receive buffer budget, potentially leading to mismatched receive-side accounting. The vulnerability was present in the stable versions of the Linux kernel.

Impact

The vulnerability could cause incorrect accounting of received data, allowing for potential memory management issues in cryptographic operations.

Reproduction

The vulnerability could be reproduced by using the AF_ALG interface with a socket that has a limited receive buffer. When the RX scatterlist extraction is performed, the operation could inadvertently exceed the available buffer budget, causing an imbalance in data accounting.

Remediation

Users can update to the latest stable version of the Linux kernel, where this vulnerability has been fixed.