In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ================================================================== [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul4klle+0xc1/0x110 [ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Workqueue: smb3decryptd smb2decryptoffload [cifs] [ 194.200032] Call Trace: [ 194.200191] <TASK> [ 194.200327] dumpstacklvl+0x4e/0x70 [ 194.200558] ? gf128mul4klle+0xc1/0x110 [ 194.200809] printreport+0x174/0x505 [ 194.201040] ? pfxrawspinlockirqsave+0x10/0x10 [ 194.201352] ? srsoreturnthunk+0x5/0x5f [ 194.201604] ? _virtaddrvalid+0xdf/0x1c0 [ 194.201868] ? gf128mul4klle+0xc1/0x110 [ 194.202128] kasanreport+0xc8/0x150 [ 194.202361] ? gf128mul4klle+0xc1/0x110 [ 194.202616] gf128mul4klle+0xc1/0x110 [ 194.202863] ghashupdate+0x184/0x210 [ 194.203103] shashahashupdate+0x184/0x2a0 [ 194.203377] ? _pfxshashahashupdate+0x10/0x10 [ 194.203651] ? srsoreturnthunk+0x5/0x5f [ 194.203877] ? cryptogcminitcommon+0x1ba/0x340 [ 194.204142] gcmhashassocremaincontinue+0x10a/0x140 [ 194.204434] cryptmessage+0xec1/0x10a0 [cifs] [ 194.206489] ? _pfxcryptmessage+0x10/0x10 [cifs] [ 194.208507] ? srsoreturnthunk+0x5/0x5f [ 194.209205] ? srsoreturnthunk+0x5/0x5f [ 194.209925] ? srsoreturnthunk+0x5/0x5f [ 194.210443] ? srsoreturnthunk+0x5/0x5f [ 194.211037] decryptrawdata+0x15f/0x250 [cifs] [ 194.212906] ? _pfxdecryptrawdata+0x10/0x10 [cifs] [ 194.214670] ? srsoreturnthunk+0x5/0x5f [ 194.215193] smb2decryptoffload+0x12a/0x6c0 [cifs] This is because TFM is being used in parallel. Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3calcsignature()). Also remove the calls to aeadrequestsetcallback() and cryptowait_req() since it's always going to be a synchronous operation.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-18.18", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-buildinfo-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-buildinfo-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-doc" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-headers-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-6.11.0-18-generic-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-64k-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-image-unsigned-6.11.0-18-generic-dbgsym" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-lib-rust-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-libc-dev" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-extra-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-ipu6-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-ipu7-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-iwlwifi-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-usbio-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-modules-vision-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-source-6.11.0" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18-generic" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-6.11.0-18-generic-64k" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-common" }, { "binary_version": "6.11.0-18.18", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-cloud-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-aws-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-buildinfo-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-cloud-tools-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-headers-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-image-unsigned-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-image-unsigned-6.11.0-1009-aws-dbgsym" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-modules-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-modules-extra-6.11.0-1009-aws" }, { "binary_version": "6.11.0-1009.10", "binary_name": "linux-tools-6.11.0-1009-aws" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-cloud-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-azure-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-cloud-tools-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-azure-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-extra-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-iwlwifi-6.11.0-1009-azure" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-azure" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1009.9", "binary_name": "linux-buildinfo-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-gcp-headers-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-gcp-tools-6.11.0-1009" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-headers-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-image-unsigned-6.11.0-1009-gcp-dbgsym" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-modules-extra-6.11.0-1009-gcp" }, { "binary_version": "6.11.0-1009.9", "binary_name": "linux-tools-6.11.0-1009-gcp" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-buildinfo-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-cloud-tools-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-headers-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-image-unsigned-6.11.0-1010-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-cloud-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-headers-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-lib-rust-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-lowlatency-tools-6.11.0-1010" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-6.11.0-1010-lowlatency-64k" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-modules-iwlwifi-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-lowlatency" }, { "binary_version": "6.11.0-1010.11", "binary_name": "linux-tools-6.11.0-1010-lowlatency-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1011.12", "binary_name": "linux-buildinfo-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-buildinfo-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-headers-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-headers-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-64k-dbgsym" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-image-unsigned-6.11.0-1011-oracle-dbgsym" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-extra-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-modules-extra-6.11.0-1011-oracle-64k" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-oracle-headers-6.11.0-1011" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-oracle-tools-6.11.0-1011" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-tools-6.11.0-1011-oracle" }, { "binary_version": "6.11.0-1011.12", "binary_name": "linux-tools-6.11.0-1011-oracle-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1008.8", "binary_name": "linux-buildinfo-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-headers-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-image-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-image-6.11.0-1008-raspi-dbgsym" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-modules-6.11.0-1008-raspi" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-raspi-headers-6.11.0-1008" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-raspi-tools-6.11.0-1008" }, { "binary_version": "6.11.0-1008.8", "binary_name": "linux-tools-6.11.0-1008-raspi" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1005.5", "binary_name": "linux-buildinfo-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-cloud-tools-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-headers-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-image-unsigned-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-image-unsigned-6.11.0-1005-realtime-dbgsym" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-extra-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-modules-iwlwifi-6.11.0-1005-realtime" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-cloud-tools-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-headers-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-realtime-tools-6.11.0-1005" }, { "binary_version": "6.11.0-1005.5", "binary_name": "linux-tools-6.11.0-1005-realtime" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-buildinfo-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-headers-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-image-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-image-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-modules-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-riscv-headers-6.11.0-17" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-riscv-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17.1", "binary_name": "linux-tools-6.11.0-17-generic" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-buildinfo-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-buildinfo-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-cloud-tools-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-headers-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-headers-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-headers-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-hwe-6.11-tools-6.11.0-17" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-64k-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-image-unsigned-6.11.0-17-generic-dbgsym" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-6.11.0-17-generic-64k" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-extra-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-ipu6-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-ipu7-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-iwlwifi-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-usbio-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-modules-vision-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-tools-6.11.0-17-generic" }, { "binary_version": "6.11.0-17.17~24.04.2", "binary_name": "linux-tools-6.11.0-17-generic-64k" } ] }