Linux Kernel mac802154 In-Place Cryptography Vulnerability Allows Data Corruption and Kernel Crashes

A vulnerability in the Linux kernel's mac802154 layer can lead to data corruption and kernel crashes. This issue arises from in-place cryptographic operations on socket buffer (skb) data, which can inadvertently modify shared data references. The problem is exacerbated under concurrent 802.15.4 traffic with security enabled, causing use-after-free errors and crashes. The vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability causes silent data corruption of skb clones, use-after-free errors when the crypto API scatterwalk writes through freed memory, and kernel crashes under concurrent 802.15.4 traffic with security enabled, as reported by KASAN/KMSAN.

Reproduction

The vulnerability can be reproduced by enabling security features in the mac802154 layer and generating concurrent traffic. The in-place cryptographic operations will then corrupt shared data buffers, leading to data corruption and potential kernel crashes.

Remediation

The vulnerability has been fixed by adding a data copying step before the in-place cryptographic operations, ensuring that the data can be safely modified without affecting other references. Users should update to the latest version of the Linux kernel where this fix has been applied.