Linux Kernel IPTFS Runtime State Cloning Vulnerability Leading to Use-After-Free and Double-Free Issues

A vulnerability in the Linux kernel's IPTFS (In-Place Transport File System) implementation can lead to use-after-free and double-free errors. The issue arises in the xfrm subsystem, where the iptfs_clone_state function improperly clones runtime state data that should not be shared with the original Security Association (SA). This includes critical runtime objects such as the sk_buff_head (socket buffer head), hrtimers (high-resolution timers), spinlocks, and in-flight reassembly or reorder states. If the xfrm_state_migrate function fails after the state has been cloned but before it is properly initialized, the garbage-collected cloned state can inadvertently free socket buffers owned by the original IPTFS queue. This vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability causes use-after-free and double-free errors, particularly in the iptfs_destroy_state function and the socket buffer release paths. Such memory management errors can lead to memory corruption, potentially allowing for arbitrary code execution or other unintended behavior.

Reproduction

To reproduce this vulnerability, clone an IPTFS state using the iptfs_clone_state function. Ensure that the xfrm_state_migrate function fails after the state has been cloned but before it is fully initialized. This will create a scenario where the cloned state is improperly managed, leading to use-after-free and double-free errors.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.