Description

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrb_msg_to_type6_ep11cprb_msgx() function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11_cprb structure and subsequent payload fields (pld_tag, pld_lenfmt) are copied from userspace without verifying sufficient buffer length. 2. Arithmetic overflow in length calculations: CEIL4 alignment could overflow, bypassing size checks and enabling buffer overflows. 3. The payload is asn1 encoded but the function just uses a simple c struct overlay to access some fields of the payload. Fix by using size_t for length calculations, adding U32_MAX boundary checks after alignment, and validating minimum request size and minimum reply size before copying from userspace. Do a very simple asn1 parsing of the payload up to the function value field.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:08.870Z",
  "pubdate": "2026-08-26T15:17:08.870Z",
  "executiveSummary": "A critical vulnerability exists in the Linux kernel s390 zcrypt subsystem, specifically within the xcrb_msg_to_type6_ep11cprb_msgx function. The vulnerability is characterized by improper input validation and arithmetic overflow, which can lead to memory corruption and potential system instability.\nThe flaw stems from the failure to validate the minimum size of the ep11_cprb structure and its associated payload fields when copied from userspace. Furthermore, the use of insecure arithmetic for length calculations allows for integer overflows, bypassing boundary checks.\nThis vulnerability poses a significant security risk as it permits local users to trigger buffer overflows via crafted userspace requests. The impact could range from system crashes to potential privilege escalation if memory can be overwritten in a controlled manner. Exploitation requires the ability to interact with the zcrypt device driver from a local userspace environment. Systems utilizing s390 crypto hardware are primarily affected, and remediation requires applying the relevant kernel patches to enforce strict boundary checks and correct length calculation logic.",
  "technicalDetails": "The vulnerability is rooted in the xcrb_msg_to_type6_ep11cprb_msgx function's handling of user-supplied data for the EP11 (Enterprise PKCS#11) adapter interface. The primary failure is the direct mapping of a C structure overlay onto untrusted memory buffers without verifying that the provided buffer length is sufficient to contain the required fields (e.g., pld_tag, pld_lenfmt).\nA secondary, critical issue involves the integer arithmetic used to calculate memory offsets and buffer sizes. The use of CEIL4 alignment calculations is susceptible to integer overflow. If the input length is maliciously crafted, the resulting calculation can wrap around, leading to an integer value that satisfies subsequent bounds checks but results in an actual allocation or copy operation that is significantly smaller than the data being processed. This disparity between the validated size and the actual buffer size triggers a heap or stack-based buffer overflow during the copy_from_user operation.\nFurthermore, the implementation incorrectly assumes the structure of an ASN.1 encoded payload by treating it as a fixed-length C struct. Because the payload is ASN.1 encoded, the length and positioning of fields vary based on the specific encoding. By forcing a C struct overlay onto this data, the kernel improperly accesses sensitive fields, which may facilitate logic errors in addition to the memory corruption issues.\nAttack flow: 1. A local attacker identifies the device node associated with the zcrypt subsystem (e.g., /dev/zcrypt). 2. The attacker constructs a malicious userspace request containing an ep11_cprb structure with deliberately malformed length fields. 3. The attacker submits this request via the appropriate ioctl interface. 4. The kernel function xcrb_msg_to_type6_ep11cprb_msgx processes the input, performing flawed arithmetic that results in an integer overflow. 5. The boundary check is bypassed because the overflowed value appears valid. 6. The kernel attempts to copy the payload into kernel memory, resulting in an out-of-bounds write. 7. The memory corruption leads to kernel panics or the potential execution of arbitrary code within the kernel context, depending on the attacker's ability to manipulate the surrounding memory layout."
}