Linux Kernel TCP-AO Key Deletion Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's TCP-AO (TCP Authentication Option) implementation. This issue arises in the asynchronous key deletion process, where certain validity checks are bypassed. Specifically, if a key is added while the socket is closed and then the socket is transitioned to the LISTEN state, the deletion can inadvertently free memory that is still in use. This flaw allows for the dereferencing of invalid memory, potentially leading to undefined behavior.

Impact

Exploitation of this vulnerability can cause a use-after-free condition, where freed memory is accessed, leading to potential memory corruption or arbitrary code execution.

Reproduction

To reproduce this vulnerability, add a TCP-AO key to a socket while it is in the CLOSE state, ensuring that the 'set_current' and 'set_rnext' options are enabled. Once the socket is in the LISTEN state, delete the key asynchronously. The deletion process will free the key without clearing the references, creating a dangling pointer. After the RCU grace period, use the 'getsockopt' function to access TCP-AO information, which will dereference the dangling pointer from the freed memory, triggering the use-after-free condition.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version where this issue has been addressed.