{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-58008", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-27T02:10:48.227Z", "datePublished": "2025-02-27T02:12:04.100Z", "dateUpdated": "2026-08-05T11:47:24.494Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:24.494Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y\n\nWith vmalloc stack addresses enabled (CONFIG_VMAP_STACK=y) DCP trusted\nkeys can crash during en- and decryption of the blob encryption key via\nthe DCP crypto driver. This is caused by improperly using sg_init_one()\nwith vmalloc'd stack buffers (plain_key_blob).\n\nFix this by always using kmalloc() for buffers we give to the DCP crypto\ndriver." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable paths are entered only through the `add_key(2)`/`keyctl` syscall interface (`trusted_instantiate()` → `trusted_dcp_seal()`/`trusted_dcp_unseal()`), which requires a local account or shell on the i.MX device. There is no network or adjacent-network protocol that reaches the DCP trusted-key code.\nAC:L - On an affected build (`CONFIG_VMAP_STACK=y`, which is `default y`, plus `CONFIG_TRUSTED_KEYS_DCP=y`, `default y` on i.MX defconfigs) the stack buffer is always a vmalloc address, so `sg_init_one()` unconditionally builds a scatterlist with an out-of-range `struct page *` on every seal and unseal — no race, timing window, or victim state is involved. The attacker can repeat `add_key()` from many threads to sweep different kernel-stack addresses and therefore different bogus PFNs, so success does not depend on conditions outside their control.\nPR:L - `add_key(2)` only needs write permission on a keyring the caller already owns (`@u`/`@s`), and `trusted_instantiate()` performs no `capable()` check on the DCP path — the sole `CAP_SYS_ADMIN` gate in trusted-keys is in TPM1 `pcrlock()`, which is unreachable here. Any unprivileged local user, including a sandboxed application, can create or load a DCP trusted key.\nUI:N - The attacker triggers the defect entirely on their own by issuing `keyctl add trusted k \"new 32\" @u` or `\"load \"`; no other user must mount a filesystem, open a file, or take any action.\nS:U - The bogus scatterlist page and the resulting wild read/write stay within the kernel's own address space and are reached through an ordinary syscall, so the vulnerable and impacted components share one security authority. No VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The seal path makes the mxs-dcp driver `memcpy()` 16 bytes from `sg_virt()` of a `struct page *` that lies outside `mem_map`, so with `CONFIG_HIGHMEM=y` the out-of-bounds `PageHighMem()` flag read can send `kmap_atomic()` at an arbitrary physical frame and the driver reads kernel memory it was never meant to touch. This wild-pointer read pairs with the wild write below to form a memory-corruption primitive that can be leveraged to disclose kernel memory, so High is the appropriate rating.\nI:H - The unseal path is worse than a read: `sg_pcopy_from_buffer()` writes 16 bytes of DCP-decrypted output through the out-of-bounds page into memory that does not belong to the buffer, an out-of-bounds write whose target is influenced by the attacker's choice of thread stack and whose contents derive from the attacker-supplied blob ciphertext. Out-of-bounds kernel writes are rated High because they can be groomed into control-flow hijacking.\nA:H - The commit explicitly states DCP trusted keys \"can crash during en- and decryption\"; dereferencing a `struct page *` past `mem_map` yields a NULL or unmapped source address for the `memcpy` or a fixmap entry pointing at nonexistent physical memory, producing a kernel oops or external abort. An unprivileged user can invoke this repeatedly via `add_key()` for a reliable denial of service on the device." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/keys/trusted-keys/trusted_dcp.c" ], "versions": [ { "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb", "lessThan": "3192f1c54dddb9b5820bf5e8677809949d8e9c66", "status": "affected", "versionType": "git" }, { "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb", "lessThan": "3355594de46fb1cba663f12b9644b664b8a609f4", "status": "affected", "versionType": "git" }, { "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb", "lessThan": "e8d9fab39d1f87b52932646b2f1e7877aa3fc0f4", "status": "affected", "versionType": "git" }, { "version": "9e3b266afcfe4294e84496f50f006f029d3100db", "status": "affected", "versionType": "git" }, { "version": "6.10.7", "lessThan": "6.11", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/keys/trusted-keys/trusted_dcp.c" ], "versions": [ { "version": "6.11", "status": "affected" }, { "version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.14", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3192f1c54dddb9b5820bf5e8677809949d8e9c66" }, { "url": "https://git.kernel.org/stable/c/3355594de46fb1cba663f12b9644b664b8a609f4" }, { "url": "https://git.kernel.org/stable/c/e8d9fab39d1f87b52932646b2f1e7877aa3fc0f4" } ], "title": "KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y", "x_generator": { "engine": "bippy-1.2.0" } } } }