Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
libceph: define and enforce CEPH_MAX_KEY_LEN
When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length.
The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is a) not universal since CEPH_CRYPTO_NONE has to be excluded and b) doesn’t provide much value since a smaller than needed key is just as invalid as no key – this has to be handled elsewhere anyway.
Details
- Affected product:
- Ubuntu 20.04 ELS
- Affected packages:
- linux-meta @ 5.4.0 (+1 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Amazon Linux 2023 | Planned | — |
| Debian 13 | Planned | — |
| Proxmox VE 7 5.15 | Released |
47 kernels
|
| Ubuntu 20.04 HWE AWS | Released |
57 kernels
|
| Ubuntu 20.04 HWE Azure | Released |
40 kernels
|
| Ubuntu 22.04 | Released |
96 kernels
|
| Ubuntu 22.04 AWS | Released |
87 kernels
|
| Ubuntu 22.04 Azure | Released |
77 kernels
|
| Ubuntu 24.04 | Planned | — |
| Ubuntu 24.04 AWS | Planned | — |