CVE-2024-42229

Summary

CVE-2024-42229 is a vulnerability in the Linux kernel's crypto subsystem where the key buffer is not zeroized after use in the aead and cipher modules. This issue fails to adhere to I.G 9.7.B of FIPS 140-3 specifications, which mandates zeroizing variables containing cryptographic information once they are no longer needed. To address this issue, the recommended action is to use kfree_sensitive for buffers that previously held private keys.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.