Linux Kernel Request Key Authorization Payload Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's key management system, specifically within the request key authorization process. This issue arises when the request_key_auth payload is not properly managed during key instantiation and rejection, leading to a reference being used after it has been freed. The vulnerability is present in the Linux kernel stable tree, affecting versions 5.10 and later.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, potentially allowing for arbitrary code execution or memory corruption.

Reproduction

The vulnerability can be reproduced by creating an authorization key and then initiating a key instantiation process that involves copying user payloads. After the payload is copied, the process can be interrupted, causing the authorization key to be detached and freed. Once the key is destroyed, the system can attempt to use the now-invalid payload reference, leading to a use-after-free scenario.

Remediation

Users can upgrade to the latest version of the Linux kernel to address this vulnerability.