CVE-2023-52669

A flaw was found in the Linux kernel's s390 Advanced Encryption Standard (AES) cipher implementation. When processing data in Counter (CTR) mode, the driver always reads a full block during the final block operation, even if fewer bytes remain. A local user could exploit this buffer over-read flaw to trigger an out-of-bounds read, causing a system crash and Denial of Service (DoS) or potentially leaking uninitialized memory.

This vulnerability is assessed with a Low severity impact because it requires local system access and is strictly limited to IBM Z (s390x) architectures running hardware-accelerated AES in CTR mode. Standard enterprise deployments on other architectures, such as x86_64 or aarch64, do not compile or execute this architecture-specific driver and remain unaffected. On vulnerable s390x installations, the consequence is primarily limited to a denial of service via a kernel crash or potential leakage of uninitialized kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.