EUVD-2026-59585
GHSA-pqhh-48h7-jg73
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local AF_ALG access requires low-privilege user; no user interaction; kernel buffer overflow enables full memory corruption so C/I/A all high.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
crypto: sun4i-ss - Remove insecure and unused rng_alg
Remove sun4i_ss_rng, as it is insecure and unused:
- It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing
locking and has a buffer overflow. sun4i_ss_prng_generate() fails to fill the entire buffer with cryptographic random bytes, because it rounds the destination length down and also doesn't actually wait for the hardware to be ready before pulling bytes from it.
- No user of this code is known. It's usable only theoretically via the
"rng" algorithm type of AF_ALG. But userspace actually just uses the actual Linux RNG (/dev/random etc) instead. And rng_algs don't contribute entropy to the actual Linux RNG either. (This may have been confused with hwrng, which does contribute entropy.)
The sun4i_ss_prng_seed() buffer overflow was reported by Tianchu Chen and discovered by Atuin - Automated Vulnerability Discovery Engine
There's no point in fixing all these vulnerabilities individually when this is unused code, so let's just remove it.
AnalysisAI
Buffer overflow and missing locking in the Linux kernel's sun4i-ss PRNG driver expose local low-privilege users on AllWinner sun4i SoC hardware to potential kernel memory corruption and privilege escalation. Two distinct flaws exist: sun4i_ss_prng_seed() lacks mutual exclusion and accepts input without bounds checking, while sun4i_ss_prng_generate() truncates output length and fails to synchronize with hardware before reading bytes, producing cryptographically unreliable output. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be met simultaneously: (1) local shell access with at least low-privilege user credentials, as confirmed by CVSS PR:L - remote exploitation is not possible; (2) the target system must be physically running AllWinner sun4i SoC hardware (A10, A13, A20, or compatible) with the sun4i-ss kernel module present and loaded - this excludes all x86, mainstream ARM Cortex-A (non-Allwinner), RISC-V, and cloud VM deployments; (3) the kernel must have CONFIG_CRYPTO_DEV_SUN4I_SS compiled in or available as a loadable module; (4) the attacker must invoke the 'rng' algorithm type via a custom PF_ALG/AF_ALG socket - no standard userspace application is known to do this, so exploitation requires purpose-built attack tooling. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite a CVSS 3.1 score of 7.8 HIGH with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, multiple converging signals substantially reduce real-world risk: EPSS of 0.18% at the 8th percentile indicates extremely low observed exploitation activity, the vulnerability is absent from CISA KEV, and no public exploit code exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to a patched kernel version: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 depending on the branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure to identify systems running Linux on AllWinner sun4i SoC hardware and document their kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today