In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done<\/p>\n
tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to
\ncrypto_aead_decrypt(req) without taking a reference on the netns, unlike
\nthe encrypt path. When crypto_aead_decrypt() is offloaded asynchronously
\n(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs
\ntipc_aead_decrypt_done() later. If the bearer’s netns is torn down in the
\nmeantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the
\nper-netns tipc_crypto, and the completion then reads it:
\ntipc_aead_decrypt_done() dereferences aead->crypto->stats and
\naead->crypto->net, and tipc_crypto_rcv_complete() dereferences
\naead->crypto->aead[] and the node table — reading freed memory.<\/p>\n
Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):<\/p>\n
BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net\/tipc\/crypto.c:999)
\n Read of size 8 at addr ffff8881056258a8 by task kworker\/u16:2\/51
\n Workqueue: events_unbound
\n Call Trace:
\n tipc_aead_decrypt_done (net\/tipc\/crypto.c:999)
\n process_one_work (kernel\/workqueue.c:3314)
\n worker_thread (kernel\/workqueue.c:3397 kernel\/workqueue.c:3478)
\n kthread (kernel\/kthread.c:436)
\n ret_from_fork (arch\/x86\/kernel\/process.c:158)
\n ret_from_fork_asm (arch\/x86\/entry\/entry_64.S:245)<\/p>\n
Allocated by task 169:
\n __kasan_kmalloc (mm\/kasan\/common.c:398 mm\/kasan\/common.c:415)
\n tipc_crypto_start (net\/tipc\/crypto.c:1502)
\n tipc_init_net (net\/tipc\/core.c:72)
\n ops_init (net\/core\/net_namespace.c:137)
\n setup_net (net\/core\/net_namespace.c:446)
\n copy_net_ns (net\/core\/net_namespace.c:579)
\n create_new_namespaces (kernel\/nsproxy.c:132)
\n __x64_sys_unshare (kernel\/fork.c:3316)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:63)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n
Freed by task 8:
\n kfree (mm\/slub.c:6566)
\n tipc_exit_net (net\/tipc\/core.c:119)
\n cleanup_net (net\/core\/net_namespace.c:704)
\n process_one_work (kernel\/workqueue.c:3314)
\n kthread (kernel\/kthread.c:436)<\/p>\n
This is the same class of bug that commit e279024617134 (“net\/tipc: fix
\nslab-use-after-free Read in tipc_aead_encrypt_done”) fixed for the encrypt
\nside. The encrypt path takes maybe_get_net(aead->crypto->net) before
\ncrypto_aead_encrypt() and drops it with put_net() on the synchronous
\nreturn paths and in tipc_aead_encrypt_done(); the -EINPROGRESS\/-EBUSY
\nreturn keeps the reference for the async callback to release. The decrypt
\npath was left without the equivalent guard.<\/p>\n
Mirror the encrypt-side fix on the decrypt path: take a net reference
\nbefore crypto_aead_decrypt() (failing with -ENODEV and the matching
\nbearer put if it cannot be acquired), keep it across the
\n-EINPROGRESS\/-EBUSY async return, and drop it with put_net() on the
\nsynchronous success\/error return and at the end of
\ntipc_aead_decrypt_done().<\/p>\n
Reproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is
\nflooded with crafted encrypted frames from an unknown peer (driving the
\ncluster-key decrypt path) while the bearer’s netns is repeatedly torn
\ndown. The completion must run asynchronously to outlive
\ntipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts
\nsynchronously, so the async path was exercised via cryptd offload. The
\nunguarded aead->crypto dereference in tipc_aead_decrypt_done() is the
\nunpatched upstream path; tipc_aead_decrypt() still lacks
\nmaybe_get_net(aead->crypto->net), so the completion can outlive the free
\non any config where crypto_aead_decrypt() goes async.<\/p>\n
Found by 0sec automated security-research tooling (https:\/\/0sec.ai).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done<\/p>\n
tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to
\ncrypto_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14878","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}