Linux Kernel rxrpc Data Decryption Vulnerability Splice Handling Improvement

A vulnerability in the Linux kernel's rxrpc implementation has been addressed. The issue involved improper handling of DATA packets decrypted in place, which could lead to corruption in the page cache. This problem arose when packets were transmitted locally using splice(), causing them to be shared in the I/O thread. The vulnerability has been fixed by removing the packet sharing and instead extracting the packet content into a dedicated buffer for decryption. The modified approach ensures that the original packet remains unchanged and that the decrypted data is correctly aligned for processing by cryptographic algorithms. Additionally, the new method enhances performance by streamlining packet distribution and acknowledgment processes. The fix also introduces a mechanism to manage the decryption buffer more effectively, particularly when using the MSG_PEEK flag, which can interfere with packet processing.

Impact

The vulnerability could lead to data corruption in the page cache, caused by in-place decryption of DATA packets transmitted locally via splice().

Reproduction

The vulnerability can be reproduced by sending DATA packets through a splice() operation, which will cause the packets to be decrypted in place, leading to page cache corruption.

Remediation

Users can apply the latest patch available in the Linux kernel stable tree to address this vulnerability.