Executive brief
A vulnerability was identified in the Linux kernel's padata framework, which manages parallel data processing. Under specific conditions, the system may attempt to access memory that has already been freed during cryptographic operations. This could allow a local attacker to cause a system crash or potentially execute unauthorized code, impacting system stability and security.
Technical details
A use-after-free (UAF) vulnerability exists in the padata_reorder function within the Linux kernel's padata framework. The root cause is a race condition where a parallel data object (pd) can have its reference count drop to zero and be freed while padata_reorder is still iterating through its loop. Specifically, if a cryptographic algorithm is deleted while padata_find_next is being called, the object may be released before the next iteration, leading to a slab-use-after-free. The fix involves adding synchronize_rcu() in padata_free_shell to ensure all serial processing calls complete before the structures are deallocated. This is a local vulnerability requiring low privileges to exploit.
Affected products
- Linux Linux Kernel 5.4 to 5.10.235, 5.11 to 5.15.179, 5.16 to 6.1.129, 6.2 to 6.6.76, 6.7 to 6.12.13, 6.13 to 6.13.2
Timeline
- 2025-01-10: patched: Initial patch authored
- 2025-02-26: disclosed: CVE assigned
- 2025-02-27: advisory: Public advisory published
References
- https://git.kernel.org/stable/c/0ae2f332cfd2d74cf3ce344ec9938cf3e29c3ccd
- https://git.kernel.org/stable/c/573ac9c70bf7885dc85d82fa44550581bfc3b738
- https://git.kernel.org/stable/c/80231f069240d52e98b6a317456c67b2eafd0781
- https://git.kernel.org/stable/c/bbccae982e9fa1d7abcb23a5ec81cb0ec883f7de
- https://git.kernel.org/stable/c/e01780ea4661172734118d2a5f41bc9720765668
- https://git.kernel.org/stable/c/f3e0b9f790f8e8065d59e67b565a83154d9f3079
- https://git.kernel.org/stable/c/f78170bee51469734b1a306a74fc5f777bb22ba6