CVE-2024-43815

HIGH

Linux Kernel < 6.10.3 - Use of Uninitialized Resource

Title source: rule
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - Ensure payload is zero when using key slot We could leak stack memory through the payload field when running AES with a key from one of the hardware's key slots. Fix this by ensuring the payload field is set to 0 in such cases. This does not affect the common use case when the key is supplied from main memory via the descriptor payload.

Scores

CVSS v3 7.1
EPSS 0.0002
EPSS Percentile 4.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-908
Status published
Products (2)
linux/Kernel 6.10.0 - 6.10.3linux
linux/linux_kernel 6.10 - 6.10.3
Published Aug 17, 2024
Tracked Since Feb 18, 2026