In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mac802154: llsec: add skb_cow_data() before in-place crypto<\/p>\n
llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),
\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform
\nin-place cryptographic transformations on skb data. They build a
\nscatterlist with sg_init_one() pointing into the skb’s linear data area
\nand then pass the same scatterlist as both src and dst to the crypto API
\n(e.g. crypto_skcipher_encrypt\/decrypt, crypto_aead_encrypt\/decrypt).<\/p>\n
On the RX path, __ieee802154_rx_handle_packet() clones the received skb
\nbefore handing it to each subscriber via ieee802154_subif_frame(). The
\ncloned skb shares the same underlying data buffer via reference
\ncounting. When llsec_do_decrypt() subsequently modifies this shared
\nbuffer in place, it corrupts data that other clones — potentially
\nbelonging to other sockets or subsystems — still reference.<\/p>\n
On the TX path, similar data sharing can occur when an skb’s head has
\nbeen cloned (skb_cloned() returns true).<\/p>\n
The fix is to call skb_cow_data() before performing any in-place crypto
\noperation. skb_cow_data() ensures that the skb’s data area is not
\nshared: if the skb head is cloned or the data spans multiple fragments,
\nit copies the data into a private buffer that can be safely modified in
\nplace. This is the same pattern used by:<\/p>\n
– ESP (net\/ipv4\/esp4.c, net\/ipv6\/esp6.c)
\n – MACsec (drivers\/net\/macsec.c)
\n – WireGuard (drivers\/net\/wireguard\/receive.c)
\n – TIPC (net\/tipc\/crypto.c)<\/p>\n
Without this guard, in-place crypto on shared skb data leads to:
\n – Silent data corruption of other skb clones
\n – Use-after-free when the crypto API scatterwalk writes through a
\n page that has already been freed by another clone’s kfree_skb()
\n – Kernel crashes under concurrent 802.15.4 traffic with security
\n enabled (KASAN\/KMSAN reports slab-use-after-free)<\/p>\n
Found by 0sec (https:\/\/0sec.ai) using automated source analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mac802154: llsec: add skb_cow_data() before in-place crypto<\/p>\n
llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),
\nllsec_do_decrypt_u<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14902","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14902","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}