Linux Kernel Keyring RCU Read Lock Vulnerability

A vulnerability in the Linux kernel's keyring code has been addressed. The issue arose because the function 'find_key_to_update()' called 'assoc_array_find()' without the proper RCU read lock. This oversight was not problematic for regular key handling, which is shielded by the keyring semaphore, but it created issues for persistent key handling, which follows a different model. The vulnerability could potentially be exploited by manipulating the keyring's locking mechanism.

Impact

The vulnerability could lead to improper key management in the keyring, particularly affecting persistent keys, and could potentially be exploited to cause memory management issues or use-after-free vulnerabilities.

Reproduction

The vulnerability can be reproduced by calling 'find_key_to_update()' in the keyring code without holding the RCU read lock. This can be done by manipulating the keyring's locking mechanism, particularly in scenarios involving persistent keys, which do not benefit from the same safeguards as regular keys.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux kernel documentation.