Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-58008
CVE-2024-58008:
Linux Debian vulnerability analysis and mitigation
Overview
CVE-2024-58008 affects the Linux kernel's trusted key system, specifically the DCP (Data Co-Processor) trusted keys functionality. The vulnerability was discovered when using vmalloc stack addresses enabled (CONFIGVMAPSTACK=y), where DCP trusted keys can crash during encryption and decryption of the blob encryption key via the DCP crypto driver. This issue stems from improper use of sginitone() with vmalloc'd stack buffers (Kernel Patch).
Technical details
The vulnerability occurs in the Linux kernel's security subsystem, specifically in the trusted keys implementation for DCP. The root cause is the improper usage of sginitone() with vmalloc'd stack buffers (plainkeyblob) when CONFIGVMAPSTACK=y is enabled. The issue affects the encryption and decryption operations of the blob encryption key through the DCP crypto driver (Kernel Patch).
Impact
When exploited, this vulnerability can cause the Linux kernel to crash during encryption and decryption operations involving DCP trusted keys, potentially leading to system instability and denial of service (Debian Tracker).
Mitigation and workarounds
The issue has been fixed by modifying the code to always use kmalloc() for buffers that are passed to the DCP crypto driver instead of using stack-allocated buffers. The fix is included in the kernel patch e8d9fab39d1f87b52932646b2f1e7877aa3fc0f4 (Kernel Patch).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management