In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: algif_skcipher – force synchronous processing on trees without ctx->state<\/p>\n
The AIO\/async path in skcipher_recvmsg() passes the socket-wide ctx->iv
\ndirectly into the skcipher request. After io_submit() the socket lock is
\ndropped and the request is processed asynchronously, so a concurrent
\nsendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request
\nrun under an attacker-controlled IV. For CTR\/stream modes this is
\nIV\/keystream reuse and lets an unprivileged user recover the plaintext of
\na concurrent operation.<\/p>\n
Snapshotting ctx->iv into per-request storage for the async path is not
\nsufficient. For ciphers with statesize == 0 – which includes cbc and ctr –
\nthe MSG_MORE inter-chunk IV chaining is carried solely by the in-place
\nreq->iv writeback, which a snapshot redirects into per-request memory that
\naf_alg_free_resources() releases on completion, silently producing wrong
\noutput. Writing the IV back from the completion callback instead is not
\npossible either: that would require lock_sock() there, but the callback can
\nrun in softirq\/atomic context, so it must not sleep.<\/p>\n
Make the operation synchronous instead, which removes both the IV race and
\nany writeback race. This is equivalent to the upstream resolution, commit
\nfcc77d33a34c (“net: Remove support for AIO on sockets”), which removed the
\nAIO socket path across net\/ entirely and so produces the same end state for
\nthis file. This patch deviates from that commit deliberately: rather than
\nremoving AIO socket support tree-wide, which would be far too invasive for
\nstable, it removes only the AIO branch in crypto\/algif_skcipher.c.
\nio_submit() now completes synchronously; AF_ALG async is rarely used in
\npractice.<\/p>\n
The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,
\nand is left alone to keep the fix minimal.<\/p>\n
Tested on 6.6.y: attacker IV injection dropped from 2296\/200000 to 0\/200000
\nafter the change; MSG_MORE chunked CTR output bit-identical to single-shot.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: algif_skcipher – force synchronous processing on trees without ctx->state<\/p>\n
The AIO\/async path in skcipher_recvmsg() passes <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7796","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}