CVE-2023-52616

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2023-52616", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-06T09:52:12.089Z", "datePublished": "2024-03-18T10:14:46.066Z", "dateUpdated": "2026-08-05T09:10:44.363Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:10:44.363Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init\n\nWhen the mpi_ec_ctx structure is initialized, some fields are not\ncleared, causing a crash when referencing the field when the\nstructure was released. Initially, this issue was ignored because\nmemory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.\nFor example, this error will be triggered when calculating the\nZa value for SM2 separately."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggered locally when an unprivileged process adds an SM2 X.509 cert via add_key/keyctl, which calls x509_get_sig_params \u2192 sm2_compute_z_digest \u2192 mpi_ec_init/deinit; no network-facing parser reaches this path.\nAC:L - The attacker solely controls the trigger by submitting an SM2 certificate; sm2_compute_z_digest allocates mpi_ec_ctx with kmalloc (non-zeroed), so garbage non-NULL d/two_inv_p values are freed reliably without depending on victim state.\nPR:L - Any unprivileged local user can add an asymmetric SM2 certificate to their own session/user keyring and exercise the vulnerable Za digest path; no CAP_SYS_ADMIN or init-namespace root is required.\nUI:N - Exploitation needs no victim action beyond the attacker\u2019s own add_key/keyctl syscall; certificate parsing and Za computation run entirely in-kernel on that request.\nS:U - Impact is confined to the host kernel\u2019s privilege boundary (crash or local privilege escalation); it does not cross VM, IOMMU, or other distinct security authorities.\nC:H - mpi_ec_deinit frees uninitialized d and two_inv_p pointers from a non-zeroed kmalloc object; with heap spraying of that cache this yields an arbitrary-free primitive that can expose kernel memory.\nI:H - The same attacker-shaped uninitialized free through mpi_free provides a classic arbitrary-free write/control-flow hijack primitive, enabling integrity compromise beyond a pure crash.\nA:H - Freeing or dereferencing garbage MPI pointers in mpi_ec_deinit causes a kernel oops/panic, producing a full denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/crypto/mpi/ec.c"], "versions": [{"version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "0c3687822259a7628c85cd21a3445cbe3c367165", "status": "affected", "versionType": "git"}, {"version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "2bb86817b33c9d704e127f92b838035a72c315b6", "status": "affected", "versionType": "git"}, {"version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "bb44477d4506e52785693a39f03cdc6a2c5e8598", "status": "affected", "versionType": "git"}, {"version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a", "status": "affected", "versionType": "git"}, {"version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "7abdfd45a650c714d5ebab564bb1b988f14d9b49", "status": "affected", "versionType": "git"}, {"version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "ba3c5574203034781ac4231acf117da917efcd2a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/crypto/mpi/ec.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.210", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.149", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.79", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.15", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.3", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.79"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0c3687822259a7628c85cd21a3445cbe3c367165"}, {"url": "https://git.kernel.org/stable/c/2bb86817b33c9d704e127f92b838035a72c315b6"}, {"url": "https://git.kernel.org/stable/c/bb44477d4506e52785693a39f03cdc6a2c5e8598"}, {"url": "https://git.kernel.org/stable/c/7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a"}, {"url": "https://git.kernel.org/stable/c/7abdfd45a650c714d5ebab564bb1b988f14d9b49"}, {"url": "https://git.kernel.org/stable/c/ba3c5574203034781ac4231acf117da917efcd2a"}], "title": "crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.368Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/0c3687822259a7628c85cd21a3445cbe3c367165", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2bb86817b33c9d704e127f92b838035a72c315b6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bb44477d4506e52785693a39f03cdc6a2c5e8598", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7abdfd45a650c714d5ebab564bb1b988f14d9b49", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ba3c5574203034781ac4231acf117da917efcd2a", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:55:16.184973Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:19.775Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/0c3687822259a7628c85cd21a3445cbe3c367165", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2bb86817b33c9d704e127f92b838035a72c315b6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bb44477d4506e52785693a39f03cdc6a2c5e8598", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/7abdfd45a650c714d5ebab564bb1b988f14d9b49", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ba3c5574203034781ac4231acf117da917efcd2a", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.368Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:55:16.184973Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:16.172Z"}}], "cna": {"title": "crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggered locally when an unprivileged process adds an SM2 X.509 cert via add_key/keyctl, which calls x509_get_sig_params \u2192 sm2_compute_z_digest \u2192 mpi_ec_init/deinit; no network-facing parser reaches this path.\nAC:L - The attacker solely controls the trigger by submitting an SM2 certificate; sm2_compute_z_digest allocates mpi_ec_ctx with kmalloc (non-zeroed), so garbage non-NULL d/two_inv_p values are freed reliably without depending on victim state.\nPR:L - Any unprivileged local user can add an asymmetric SM2 certificate to their own session/user keyring and exercise the vulnerable Za digest path; no CAP_SYS_ADMIN or init-namespace root is required.\nUI:N - Exploitation needs no victim action beyond the attacker\u2019s own add_key/keyctl syscall; certificate parsing and Za computation run entirely in-kernel on that request.\nS:U - Impact is confined to the host kernel\u2019s privilege boundary (crash or local privilege escalation); it does not cross VM, IOMMU, or other distinct security authorities.\nC:H - mpi_ec_deinit frees uninitialized d and two_inv_p pointers from a non-zeroed kmalloc object; with heap spraying of that cache this yields an arbitrary-free primitive that can expose kernel memory.\nI:H - The same attacker-shaped uninitialized free through mpi_free provides a classic arbitrary-free write/control-flow hijack primitive, enabling integrity compromise beyond a pure crash.\nA:H - Freeing or dereferencing garbage MPI pointers in mpi_ec_deinit causes a kernel oops/panic, producing a full denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "0c3687822259a7628c85cd21a3445cbe3c367165", "versionType": "git"}, {"status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "2bb86817b33c9d704e127f92b838035a72c315b6", "versionType": "git"}, {"status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "bb44477d4506e52785693a39f03cdc6a2c5e8598", "versionType": "git"}, {"status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a", "versionType": "git"}, {"status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "7abdfd45a650c714d5ebab564bb1b988f14d9b49", "versionType": "git"}, {"status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "lessThan": "ba3c5574203034781ac4231acf117da917efcd2a", "versionType": "git"}], "programFiles": ["lib/crypto/mpi/ec.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"status": "unaffected", "version": "0", "lessThan": "5.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.210", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.149", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.79", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.15", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.3", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["lib/crypto/mpi/ec.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0c3687822259a7628c85cd21a3445cbe3c367165"}, {"url": "https://git.kernel.org/stable/c/2bb86817b33c9d704e127f92b838035a72c315b6"}, {"url": "https://git.kernel.org/stable/c/bb44477d4506e52785693a39f03cdc6a2c5e8598"}, {"url": "https://git.kernel.org/stable/c/7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a"}, {"url": "https://git.kernel.org/stable/c/7abdfd45a650c714d5ebab564bb1b988f14d9b49"}, {"url": "https://git.kernel.org/stable/c/ba3c5574203034781ac4231acf117da917efcd2a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init\n\nWhen the mpi_ec_ctx structure is initialized, some fields are not\ncleared, causing a crash when referencing the field when the\nstructure was released. Initially, this issue was ignored because\nmemory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.\nFor example, this error will be triggered when calculating the\nZa value for SM2 separately."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.210", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.149", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.79", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.15", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.3", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:10:44.363Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52616", "state": "PUBLISHED", "dateUpdated": "2026-08-05T09:10:44.363Z", "dateReserved": "2024-03-06T09:52:12.089Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-18T10:14:46.066Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["lib/crypto/mpi/ec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0c3687822259a7628c85cd21a3445cbe3c367165", "status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "versionType": "git"}, {"lessThan": "2bb86817b33c9d704e127f92b838035a72c315b6", "status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "versionType": "git"}, {"lessThan": "bb44477d4506e52785693a39f03cdc6a2c5e8598", "status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "versionType": "git"}, {"lessThan": "7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a", "status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "versionType": "git"}, {"lessThan": "7abdfd45a650c714d5ebab564bb1b988f14d9b49", "status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "versionType": "git"}, {"lessThan": "ba3c5574203034781ac4231acf117da917efcd2a", "status": "affected", "version": "d58bb7e55a8a65894cc02f27c3e2bf9403e7c40f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["lib/crypto/mpi/ec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.210", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.79", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D2F0709-60B3-49A5-80BB-D9815B21843F", "versionEndExcluding": "5.10.210", "versionStartIncluding": "5.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D0465BB-4053-4E15-9137-6696EBAE90FD", "versionEndExcluding": "5.15.149", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "656E2F29-1779-4EFC-AA64-8F984E2885B1", "versionEndExcluding": "6.1.79", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "87C718CB-AE3D-4B07-B4D9-BFF64183C468", "versionEndExcluding": "6.6.15", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "58FD5308-148A-40D3-B36A-0CA6B434A8BF", "versionEndExcluding": "6.7.3", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init\n\nWhen the mpi_ec_ctx structure is initialized, some fields are not\ncleared, causing a crash when referencing the field when the\nstructure was released. Initially, this issue was ignored because\nmemory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.\nFor example, this error will be triggered when calculating the\nZa value for SM2 separately."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: crypto: lib/mpi: corrige el acceso inesperado al puntero en mpi_ec_init Cuando se inicializa la estructura mpi_ec_ctx, algunos campos no se borran, lo que provoca un bloqueo al hacer referencia al campo cuando se lanz\u00f3 la estructura. Inicialmente, este problema se ignor\u00f3 porque la memoria para mpi_ec_ctx se asigna con el indicador __GFP_ZERO. Por ejemplo, este error se activar\u00e1 al calcular el valor Za para SM2 por separado."}], "id": "CVE-2023-52616", "lastModified": "2026-08-04T10:18:34.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-52616", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:55:16.184973Z", "version": "2.0.3"}}]}, "published": "2024-03-18T11:15:08.967", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/0c3687822259a7628c85cd21a3445cbe3c367165"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/2bb86817b33c9d704e127f92b838035a72c315b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7abdfd45a650c714d5ebab564bb1b988f14d9b49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/ba3c5574203034781ac4231acf117da917efcd2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/bb44477d4506e52785693a39f03cdc6a2c5e8598"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/0c3687822259a7628c85cd21a3445cbe3c367165"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/2bb86817b33c9d704e127f92b838035a72c315b6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7abdfd45a650c714d5ebab564bb1b988f14d9b49"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/7ebf812b7019fd2d4d5a7ca45ef4bf3a6f4bda0a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/ba3c5574203034781ac4231acf117da917efcd2a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/bb44477d4506e52785693a39f03cdc6a2c5e8598"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init", "id": "2270091", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270091"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ncrypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init\nWhen the mpi_ec_ctx structure is initialized, some fields are not\ncleared, causing a crash when referencing the field when the\nstructure was released. Initially, this issue was ignored because\nmemory for mpi_ec_ctx is allocated with the __GFP_ZERO flag.\nFor example, this error will be triggered when calculating the\nZa value for SM2 separately.", "A vulnerability was found in the crypto: lib/mpi component of the Linux kernel, where the initialization of the mpi_ec_ctx structure caused crashes due to uncleared fields. This issue occurs when the structure is referenced after being released. It typically triggers during specific calculations, like the Za value for SM2."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2023-52616", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52616\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52616\nhttps://lore.kernel.org/linux-cve-announce/20240318101458.2835626-11-lee@kernel.org/T"], "threat_severity": "Moderate"}

{}