Message-ID: <2025061832-CVE-2025-38052-6201@gregkh>
Date: Wed, 18 Jun 2025 11:33:47 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38052: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done

Syzbot reported a slab-use-after-free with the following call trace:

  ==================================================================
  BUG: KASAN: slab-use-after-free in tipc_aead_encrypt_done+0x4bd/0x510 net/tipc/crypto.c:840
  Read of size 8 at addr ffff88807a733000 by task kworker/1:0/25

  Call Trace:
   kasan_report+0xd9/0x110 mm/kasan/report.c:601
   tipc_aead_encrypt_done+0x4bd/0x510 net/tipc/crypto.c:840
   crypto_request_complete include/crypto/algapi.h:266
   aead_request_complete include/crypto/internal/aead.h:85
   cryptd_aead_crypt+0x3b8/0x750 crypto/cryptd.c:772
   crypto_request_complete include/crypto/algapi.h:266
   cryptd_queue_worker+0x131/0x200 crypto/cryptd.c:181
   process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231

  Allocated by task 8355:
   kzalloc_noprof include/linux/slab.h:778
   tipc_crypto_start+0xcc/0x9e0 net/tipc/crypto.c:1466
   tipc_init_net+0x2dd/0x430 net/tipc/core.c:72
   ops_init+0xb9/0x650 net/core/net_namespace.c:139
   setup_net+0x435/0xb40 net/core/net_namespace.c:343
   copy_net_ns+0x2f0/0x670 net/core/net_namespace.c:508
   create_new_namespaces+0x3ea/0xb10 kernel/nsproxy.c:110
   unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228
   ksys_unshare+0x419/0x970 kernel/fork.c:3323
   __do_sys_unshare kernel/fork.c:3394

  Freed by task 63:
   kfree+0x12a/0x3b0 mm/slub.c:4557
   tipc_crypto_stop+0x23c/0x500 net/tipc/crypto.c:1539
   tipc_exit_net+0x8c/0x110 net/tipc/core.c:119
   ops_exit_list+0xb0/0x180 net/core/net_namespace.c:173
   cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640
   process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231

After freed the tipc_crypto tx by delete namespace, tipc_aead_encrypt_done
may still visit it in cryptd_queue_worker workqueue.

I reproduce this issue by:
  ip netns add ns1
  ip link add veth1 type veth peer name veth2
  ip link set veth1 netns ns1
  ip netns exec ns1 tipc bearer enable media eth dev veth1
  ip netns exec ns1 tipc node set key this_is_a_master_key master
  ip netns exec ns1 tipc bearer disable media eth dev veth1
  ip netns del ns1

The key of reproduction is that, simd_aead_encrypt is interrupted, leading
to crypto_simd_usable() return false. Thus, the cryptd_queue_worker is
triggered, and the tipc_crypto tx will be visited.

  tipc_disc_timeout
    tipc_bearer_xmit_skb
      tipc_crypto_xmit
        tipc_aead_encrypt
          crypto_aead_encrypt
            // encrypt()
            simd_aead_encrypt
              // crypto_simd_usable() is false
              child = &ctx->cryptd_tfm->base;

  simd_aead_encrypt
    crypto_aead_encrypt
      // encrypt()
      cryptd_aead_encrypt_enqueue
        cryptd_aead_enqueue
          cryptd_enqueue_request
            // trigger cryptd_queue_worker
            queue_work_on(smp_processor_id(), cryptd_wq, &cpu_queue->work)

Fix this by holding net reference count before encrypt.

The Linux kernel CVE team has assigned CVE-2025-38052 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 and fixed in 5.10.238 with commit d42ed4de6aba232d946d20653a70f79158a6535b
	Issue introduced in 5.5 with commit fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 and fixed in 5.15.185 with commit f5c2c4eaaa5a8e7e0685ec031d480e588e263e59
	Issue introduced in 5.5 with commit fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 and fixed in 6.1.141 with commit b8fcae6d2e93c54cacb8f579a77d827c1c643eb5
	Issue introduced in 5.5 with commit fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 and fixed in 6.6.93 with commit b19fc1d0be3c3397e5968fe2627f22e7f84673b1
	Issue introduced in 5.5 with commit fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 and fixed in 6.12.31 with commit 689a205cd968a1572ab561b0c4c2d50a10e9d3b0
	Issue introduced in 5.5 with commit fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 and fixed in 6.14.9 with commit 4a0fddc2c0d5c28aec8c262ad4603be0bef1938c
	Issue introduced in 5.5 with commit fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 and fixed in 6.15 with commit e279024617134c94fd3e37470156534d5f2b3472

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38052
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/tipc/crypto.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d42ed4de6aba232d946d20653a70f79158a6535b
	https://git.kernel.org/stable/c/f5c2c4eaaa5a8e7e0685ec031d480e588e263e59
	https://git.kernel.org/stable/c/b8fcae6d2e93c54cacb8f579a77d827c1c643eb5
	https://git.kernel.org/stable/c/b19fc1d0be3c3397e5968fe2627f22e7f84673b1
	https://git.kernel.org/stable/c/689a205cd968a1572ab561b0c4c2d50a10e9d3b0
	https://git.kernel.org/stable/c/4a0fddc2c0d5c28aec8c262ad4603be0bef1938c
	https://git.kernel.org/stable/c/e279024617134c94fd3e37470156534d5f2b3472

Powered by blists - more mailing lists