CVE-2024-45004

What it actually does

In-place decryption of the blob encryption key (BEK) for DCP-based trusted keys modifies the stored blob, causing subsequent exports to return the plaintext BEK to userspace instead of the encrypted value.

Why it matters to the business

Exposure of encryption key material can compromise protected data or allow attackers to decrypt other keys and secrets handled by the affected system, increasing risk for organizations relying on Linux kernel trusted keys with DCP hardware.

How an attack unfolds

An attacker with local access imports a DCP-based trusted key blob into the kernel, then triggers an export operation; the kernel returns the now-plaintext BEK via the userspace interface, enabling capture of the key without further privileges.

How to fix it

Upgrade the Linux kernel to version 6.10.7 or later, or apply the fix from commit 9e3b266afcfe4294e84496f50f006f029d3100db. For affected Go components update github.com/fluxcd/source-controller to 1.2.5 or newer. Reboot systems after kernel updates and regenerate any DCP-based trusted keys that were previously imported and exported.

How to confirm the fix worked

Confirm the running kernel version is 6.10.7 or higher; inspect the trusted key DCP code path to verify BEK operations now use a dedicated buffer with explicit wiping; test by importing then exporting a DCP key and confirming only encrypted material is returned.

Typical attack path

1. Obtain or craft a DCP-based trusted key blob
2. Import the blob into the kernel trusted key subsystem
3. Perform an export/read operation on the imported key
4. Capture the plaintext BEK returned to userspace

How to detect it

Review kernel audit logs and process activity for sequences of trusted key import followed by export operations on DCP-backed keys; inspect userspace output or memory captures for unexpected plaintext key material following such operations.

What your security team should do

• Apply kernel updates to 6.10.7+ immediately on all systems using DCP trusted keys
• Audit code and scripts that import then export trusted keys and refactor to avoid the pattern
• Regenerate and re-seal any DCP-based keys that may have been exported after import
• Monitor for new kernel releases and test patches in staging before broad deployment