CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's keyring functionality, specifically in the `keyring_get_key_chunk()` function, which improperly handles out-of-bounds reads due to insufficient bounds-checking on key descriptions. This flaw can be exploited by unprivileged users to craft colliding keys, potentially leading to unauthorized access to sensitive memory areas and exposing system information. Organizations using Linux systems should prioritize this issue to mitigate risks associated with potential data leakage and system integrity violations.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyring_get_key_chunk() For description-level chunks keyring_get_key_chunk() advances the read pointer by level * sizeof(long) past the inline prefix but only bounds-checks the prefix, so a long enough key description is read past its kmemdup(desc, desc_len + 1) allocation. Compute the full byte offset and bounds-check the description against it before reading. The walk only reaches a description-level chunk when two keys collide through the hash, x, type and domain_tag chunks, so this is reached from an unprivileged add_key(2) with a crafted pair of same-type keys whose index hashes collide; KASAN reports a slab-out-of-bounds read.