Linux Kernel TIPC Slab-Use-After-Free Vulnerability in AEAD Decryption

A slab-use-after-free vulnerability has been identified in the Linux kernel's TIPC (Transparent Inter-Process Communication) module, specifically within the AEAD (Authenticated Encryption with Associated Data) decryption process. This issue arises because the decryption function does not properly manage references to the network namespace, unlike the encryption counterpart. When the decryption operation is offloaded for asynchronous processing, it can lead to the decryption completion function accessing freed memory, causing a use-after-free error. This vulnerability was reproduced under the Kernel Address Sanitizer (KASAN) with a specific workload that exploited the missing reference management, highlighting the potential for memory corruption.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, where the decryption process accesses memory that has already been freed, potentially allowing for arbitrary memory reads and corruption.

Reproduction

The vulnerability can be reproduced by creating a UDP bearer with a cluster key and flooding it with crafted encrypted frames from an unknown peer. This drives the cluster-key decrypt path while the bearer's network namespace is repeatedly torn down. The asynchronous completion of the decryption process can then outlive the cleanup of the TIPC crypto context, leading to the use-after-free condition.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux kernel documentation.