CVE-2023-52669

What it actually does

Buffer overread in the s390 AES-CTR implementation where the final partial block always triggers a full-block read instead of using the actual remaining length, allowing access past the end of the input buffer during crypto processing.

Why it matters to the business

On IBM Z mainframes, affected Linux kernels may experience memory-safety issues during AES-CTR operations, potentially leading to information disclosure or crashes in encryption workloads; the issue has low public exploitability and was resolved nearly two years ago with no ransomware or KEV listings.

How an attack unfolds

An attacker supplies crafted input that results in a partial final block during AES-CTR encryption or decryption on s390 hardware; the kernel code reads beyond the supplied buffer, which an adversary could attempt to turn into an information leak if they control surrounding memory layout.

How to fix it

Update the Linux kernel to a version containing commit cd51e26a3b89706beec64f2d8296cfb1c34e0c79 or later; rebuild and deploy the fixed kernel across all s390 systems that use the aes_s390 module for CTR mode.

How to confirm the fix worked

Confirm the running kernel contains cd51e26a3b89706beec64f2d8296cfb1c34e0c79, verify the aes_s390 module no longer performs full-block reads on partial data via source inspection or runtime testing with short CTR inputs, and monitor for any remaining partial-block overreads in crypto self-tests.

Typical attack path

1. Locate s390-based Linux system performing AES-CTR crypto operations
2. Trigger encryption/decryption of data whose length is not a multiple of the AES block size
3. Force the CTR implementation to process a final partial block
4. Observe or exploit the resulting overread of adjacent kernel memory

How to detect it

Review kernel logs for s390 crypto-related faults or oops messages around AES-CTR operations; search system call traces or crypto API usage logs for short input lengths to CTR transforms on s390 hardware; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrades on all s390 platforms within the next maintenance window
• Audit any custom crypto code paths that rely on AES-CTR to ensure they handle partial blocks safely
• Add kernel version checks to deployment pipelines to prevent reintroduction of the vulnerable commit