rpms/libkcapi
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-71226

Browse Source 
Fix memory corruption via uncanceled AIO requests
on error in libkcapi's one-shot AIO path

Resolves: RHEL-224809

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-18 12:48:07 +02:00
parent f1635cef2c
commit ee4dc5b13b
2 changed files with 83 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
006-CVE-2026-71226.patch Normal file
View File

@ -0,0 +1,76 @@
diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c
index 0df1a02..9f93603 100644
--- a/lib/kcapi-kernel-if.c
+++ b/lib/kcapi-kernel-if.c
@@ -421,6 +421,8 @@ ssize_t _kcapi_common_vmsplice_chunk(struct kcapi_handle *handle,
int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread,
struct timespec *timeout)
{
+ int err = 0;
+
if (toread > KCAPI_AIO_CONCURRENT)
return -EINVAL;
@@ -431,41 +433,34 @@ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread,
events, timeout);
if (rc < 0)
- return rc;
+ return err == 0 ? rc : err;
for (i = 0; i < rc; i++) {
struct iocb *cb;
+ uint64_t idx = events[i].data;
- /*
- * If one cipher operation fails, so will the entire
- * AIO operation
- */
- if (events[i].res < 0) {
- handle->aio.iocb_ret[events[i].data] =
- events[i].res;
- return (int)events[i].res;
+ if (idx >= KCAPI_AIO_CONCURRENT) {
+ if (err == 0)
+ err = -EOVERFLOW;
+ continue;
}
cb = (struct iocb *)(uintptr_t)events[i].obj;
- /*
- * Older symmetric AIO implementations used a wrong
- * return code.
- */
- if (events[i].res > 0) {
- handle->aio.iocb_ret[events[i].data] =
- events[i].res;
+ if (events[i].res == 0) {
+ handle->aio.iocb_ret[idx] = (__s64)cb->aio_nbytes;
} else {
- handle->aio.iocb_ret[events[i].data] =
- (__s64)cb->aio_nbytes;
+ handle->aio.iocb_ret[idx] = events[i].res;
+ if (events[i].res < 0 && err == 0)
+ err = (int)events[i].res;
}
cb->aio_fildes = 0;
}
- toread -= (uint32_t)rc;
+ toread -= (size_t)rc;
}
- return 0;
+ return err;
}
int _kcapi_aio_send_iov(struct kcapi_handle *handle, struct iovec *iov,
@@ -541,6 +536,7 @@ int _kcapi_aio_read_iov(struct kcapi_handle *handle,
} else {
kcapi_dolog(KCAPI_LOG_ERR,
"Could not sumbit AIO read\n");
+ _kcapi_aio_read_all(handle, (size_t)ret, NULL);
return -EIO;
}
}

8
libkcapi.spec
View File

@ -124,7 +124,7 @@ done \
Name: libkcapi
Version: %{vmajor}.%{vminor}.%{vpatch}
Release: 2%{?dist}
Release: 3%{?dist}
Summary: User space interface to the Linux Kernel Crypto API
License: BSD-3-Clause OR GPL-2.0-only
@ -139,6 +139,7 @@ Patch2: 002-fips-disable-ansi_cprng.patch
Patch3: 003-zeroize-hasher.patch
Patch4: 004-hasher-target-option.patch
Patch5: 005-fips-mode-tests.patch
Patch6: 006-CVE-2026-71226.patch
BuildRequires: bash
BuildRequires: coreutils
@ -517,6 +518,11 @@ popd
%changelog
* Tue Aug 18 2026 Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-3
- CVE-2026-71226: Fix memory corruption via uncanceled AIO requests
on error in libkcapi's one-shot AIO path
Resolves: RHEL-224809
* Fri Dec 01 2023 Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
- Backport fixes for kcapi-hasher target option
Related: RHEL-15300