Linux Kernel Authenticated Encryption with ESP/ESN Vulnerability Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in the Linux kernel's handling of authenticated encryption with associated data (AAD) in the ESP/ESN context. The issue arises in the 'authencesn' crypto module, where AAD lengths shorter than the minimum required can cause the decryption function to access memory beyond the intended buffer. This leads to a NULL pointer dereference, causing a kernel panic. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to a kernel panic, causing a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by sending an ESP/ESN-formatted AAD with an associated length shorter than 8 bytes to the 'crypto_authenc_esn_decrypt()' function. This can be done by creating a custom AAD that violates the length requirement and processing it through the encryption or decryption interface that does not properly validate the AAD length before use.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the official Linux kernel website.