rpms/libkcapi
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-71227

Browse Source 
Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all()
due to unhandled io_getevents() timeout return

Resolves: RHEL-224975

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-18 12:49:14 +02:00
parent ee4dc5b13b
commit 29135cdfc5
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
007-CVE-2026-71227.patch Normal file
View File

@ -0,0 +1,22 @@
diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c
index 8a12c09..a54cdaa 100644
--- a/lib/kcapi-kernel-if.c
+++ b/lib/kcapi-kernel-if.c
@@ -436,6 +436,8 @@ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread,
if (rc < 0)
return err == 0 ? rc : err;
+ if (rc == 0)
+ return err == 0 ? -ETIMEDOUT : err;
for (i = 0; i < rc; i++) {
struct iocb *cb;
@@ -509,7 +511,7 @@ int _kcapi_aio_read_iov(struct kcapi_handle *handle,
timeout.tv_sec = 0;
timeout.tv_nsec = 10000;
ret = _kcapi_aio_read_all(handle, iovlen, &timeout);
- if (ret < 0)
+ if (ret < 0 && ret != -ETIMEDOUT)
return ret;
}

4
libkcapi.spec
View File

@ -140,6 +140,7 @@ Patch3: 003-zeroize-hasher.patch
Patch4: 004-hasher-target-option.patch
Patch5: 005-fips-mode-tests.patch
Patch6: 006-CVE-2026-71226.patch
Patch7: 007-CVE-2026-71227.patch
BuildRequires: bash
BuildRequires: coreutils
@ -522,6 +523,9 @@ popd
- CVE-2026-71226: Fix memory corruption via uncanceled AIO requests
on error in libkcapi's one-shot AIO path
Resolves: RHEL-224809
- CVE-2026-71227: Fix infinite loop denial of service in libkcapi
_kcapi_aio_read_all() due to unhandled io_getevents() timeout return
Resolves: RHEL-224975
* Fri Dec 01 2023 Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
- Backport fixes for kcapi-hasher target option