Description

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt operation with incorrect rctx->cryptlen will lead to a write beyound rctx->dst_sg buffer. As a follow-up cleanup delete struct tegra_aead_ctx->authsize field since it appears to be completely unused. Also simplify tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions respectively.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:05.800Z",
  "pubdate": "2026-08-26T15:17:05.800Z",
  "executiveSummary": "A memory corruption vulnerability exists within the Linux kernel's Tegra crypto driver, specifically affecting GCM (Galois/Counter Mode) operation handling.\nThe vulnerability is categorized as an out-of-bounds memory write, triggered by an incorrect calculation of the cryptlen parameter when the authentication tag size has not been explicitly configured via tegra_gcm_setauthsize().\nThis flaw impacts the integrity and availability of the system, potentially allowing a local attacker to cause kernel-level memory corruption.\nExploitation requires the ability to trigger cryptographic operations through the kernel API, typically originating from a privileged local process.\nSuccessful exploitation leads to an out-of-bounds write beyond the bounds of the rctx->dst_sg buffer, resulting in system instability or potential kernel panic.\nThe remediation involves synchronizing the cryptlen calculation logic across the driver's GCM and CCM implementations and removing redundant, uninitialized authentication tag size fields.",
  "technicalDetails": "The root cause of the vulnerability resides in the tegra_gcm_do_one_req() function within the Tegra cryptographic driver. The function improperly calculates the cryptlen parameter used during GCM decryption operations.\nSpecifically, the calculation logic fails to account for cases where the ctx->authsize field remains at its default value of zero, occurring when a user-space or kernel-space caller omits a call to tegra_gcm_setauthsize().\nIn the event of an uninitialized authsize, the driver derives an incorrect, inflated cryptlen value. When this value is subsequently used in a decryption operation, the driver performs a write operation that exceeds the allocated memory boundaries of the destination scatter-gather buffer (rctx->dst_sg).\nThe attack flow begins when an attacker triggers an AEAD (Authenticated Encryption with Associated Data) operation via the crypto API. By bypassing the setauthsize initialization step, the attacker forces the driver to utilize the flawed formula in tegra_gcm_do_one_req().\nDuring the decryption process, the discrepancy between the calculated length and the actual physical buffer size causes the kernel to write data into adjacent memory regions. This constitutes a classic heap-based out-of-bounds write condition.\nThe vulnerability is exacerbated by the presence of unused and potentially misleading metadata in the tegra_aead_ctx structure, specifically the authsize field, which adds unnecessary complexity and potential for state synchronization errors. The cleanup involves removing this field entirely and simplifying the tegra_ccm_setauthsize() and tegra_gcm_setauthsize() functions to ensure consistency.\nThe impact is severe, as kernel-level memory corruption can lead to arbitrary code execution if the attacker can influence the contents of the memory being overwritten, or reliably induce a denial-of-service state through kernel panics. Because the cryptographic operations are handled by the kernel, this exploit vector is generally restricted to local users with sufficient privileges to interact with crypto driver interfaces."
}