Debian: CVE-2024-50047: linux -- security update

Debian: CVE-2024-50047: linux -- security update

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

10/21/2024

Created

02/11/2025

Added

02/10/2025

Modified

02/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [194.196391] ================================================================== [194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110 [194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899 [194.197707] [194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs] [194.200032] Call Trace: [194.200191]<TASK> [194.200327]dump_stack_lvl+0x4e/0x70 [194.200558]? gf128mul_4k_lle+0xc1/0x110 [194.200809]print_report+0x174/0x505 [194.201040]? __pfx__raw_spin_lock_irqsave+0x10/0x10 [194.201352]? srso_return_thunk+0x5/0x5f [194.201604]? __virt_addr_valid+0xdf/0x1c0 [194.201868]? gf128mul_4k_lle+0xc1/0x110 [194.202128]kasan_report+0xc8/0x150 [194.202361]? gf128mul_4k_lle+0xc1/0x110 [194.202616]gf128mul_4k_lle+0xc1/0x110 [194.202863]ghash_update+0x184/0x210 [194.203103]shash_ahash_update+0x184/0x2a0 [194.203377]? __pfx_shash_ahash_update+0x10/0x10 [194.203651]? srso_return_thunk+0x5/0x5f [194.203877]? crypto_gcm_init_common+0x1ba/0x340 [194.204142]gcm_hash_assoc_remain_continue+0x10a/0x140 [194.204434]crypt_message+0xec1/0x10a0 [cifs] [194.206489]? __pfx_crypt_message+0x10/0x10 [cifs] [194.208507]? srso_return_thunk+0x5/0x5f [194.209205]? srso_return_thunk+0x5/0x5f [194.209925]? srso_return_thunk+0x5/0x5f [194.210443]? srso_return_thunk+0x5/0x5f [194.211037]decrypt_raw_data+0x15f/0x250 [cifs] [194.212906]? __pfx_decrypt_raw_data+0x10/0x10 [cifs] [194.214670]? srso_return_thunk+0x5/0x5f [194.215193]smb2_decrypt_offload+0x12a/0x6c0 [cifs] This is because TFM is being used in parallel. Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3_calc_signature()). Also remove the calls to aead_request_set_callback() and crypto_wait_req() since it's always going to be a synchronous operation.

Solution(s)

• debian-upgrade-linux

References

• https://attackerkb.com/topics/cve-2024-50047
• CVE - 2024-50047
• DSA-5860-1