{"id":"DEBIAN-CVE-2023-53599","details":"In the Linux kernel, the following vulnerability has been resolved:  crypto: af_alg - Fix missing initialisation affecting gcm-aes-s390  Fix af_alg_alloc_areq() to initialise areq-\u003efirst_rsgl.sgl.sgt.sgl to point to the scatterlist array in areq-\u003efirst_rsgl.sgl.sgl.  Without this, the gcm-aes-s390 driver will oops when it tries to do gcm_walk_start() on req-\u003edst because req-\u003edst is set to the value of areq-\u003efirst_rsgl.sgl.sgl by _aead_recvmsg() calling aead_request_set_crypt().  The problem comes if an empty ciphertext is passed: the loop in af_alg_get_rsgl() just passes straight out and doesn't set areq-\u003efirst_rsgl up.  This isn't a problem on x86_64 using gcmaes_crypt_by_sg() because, as far as I can tell, that ignores req-\u003edst and only uses req-\u003esrc[*].  [*] Is this a bug in aesni-intel_glue.c?  The s390x oops looks something like:   Unable to handle kernel pointer dereference in virtual kernel address space  Failing address: 0000000a00000000 TEID: 0000000a00000803  Fault in home space mode while using kernel ASCE.  AS:00000000a43a0007 R3:0000000000000024  Oops: 003b ilc:2 [#1] SMP  ...  Call Trace:   [\u003c000003ff7fc3d47e\u003e] gcm_walk_start+0x16/0x28 [aes_s390]   [\u003c00000000a2a342f2\u003e] crypto_aead_decrypt+0x9a/0xb8   [\u003c00000000a2a60888\u003e] aead_recvmsg+0x478/0x698   [\u003c00000000a2e519a0\u003e] sock_recvmsg+0x70/0xb0   [\u003c00000000a2e51a56\u003e] sock_read_iter+0x76/0xa0   [\u003c00000000a273e066\u003e] vfs_read+0x26e/0x2a8   [\u003c00000000a273e8c4\u003e] ksys_read+0xbc/0x100   [\u003c00000000a311d808\u003e] __do_syscall+0x1d0/0x1f8   [\u003c00000000a312ff30\u003e] system_call+0x70/0x98  Last Breaking-Event-Address:   [\u003c000003ff7fc3e6b4\u003e] gcm_aes_crypt+0x104/0xa68 [aes_s390]","modified":"2026-09-15T09:03:01.777800117Z","published":"2025-10-04T16:15:56.497Z","upstream":["CVE-2023-53599"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53599"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53599.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53599.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}