CVE-2024-26582: Linux kernel kTLS Use-After-Free

CVE-2024-26582 is a use-after-free vulnerability in the Linux kernel's in-kernel TLS (kTLS) software receive path (net/tls/tls_sw.c). When a kTLS session uses asynchronous decryption and the receiving application performs a partial read (reading fewer bytes than the TLS record size), the tls_decrypt_done() completion callback incorrectly frees pages belonging to the clear_skb buffer. These freed pages are subsequently accessed by process_rx_list() when the application reads the remaining data, triggering a use-after-free. The fix (commit 32b55c5ff9103b8508c1e04bfa5a08c64e7a925f) adds a free_sgout flag to track whether tls_decrypt_sg() actually allocated the destination pages, and only frees them when they were newly allocated.

• Package/component affected: Linux kernel kTLS software implementation (net/tls/tls_sw.c)
• Affected versions: Linux 6.2.0 through 6.6.18 (fixed in 6.6.19+, 6.7.7+, 6.1.82+, 6.8-rc3)
• Risk level: High — kernel-space use-after-free can lead to memory corruption, information leaks, or potentially privilege escalation
• Consequences: An attacker who can establish a kTLS session and control the read pattern (partial reads) can trigger premature page freeing, leading to use-after-free when the freed pages are accessed. With page poisoning or KASAN, this manifests as data corruption or sanitizer reports. Without sanitizers, this could lead to silent memory corruption or exploitation.

Impact Parity

• Disclosed/claimed maximum impact: Memory corruption (use-after-free in kernel space)
• Reproduced impact from this run: Memory corruption confirmed via KASAN use-after-free report and data corruption (page poisoning). The KASAN report shows a read of freed memory in copyout() called from process_rx_list() → tls_sw_recvmsg(). Data mismatch detected when freed pages are poisoned.
• Parity: full — the claimed memory corruption impact is fully reproduced with KASAN detection and data corruption evidence.
• Not demonstrated: Code execution / privilege escalation (the UAF is demonstrated as memory corruption, not exploit chain to code execution).

Root Cause

The vulnerability is in tls_decrypt_done() in net/tls/tls_sw.c. This function is the async completion callback for AEAD decryption in the kTLS software receive path.

The bug: tls_decrypt_done() uses the check if (sgout != sgin) to determine whether to free destination pages. This check was intended to distinguish in-place decryption (where destination and source scatterlists are the same, so no pages should be freed) from non-in-place decryption (where destination pages were allocated and should be freed). However, the check is incorrect because sgout != sgin is also true when sgout points to pages from clear_skb (allocated by tls_alloc_clrtxt_skb()), not just when pages were newly allocated by tls_decrypt_sg().

The flow:

1. tls_sw_recvmsg() is called with a partial read (len < record_size)
2. darg.zc = false because to_decrypt > len (record doesn't fit in user buffer)
3. tls_decrypt_sg() takes the clear_skb path: allocates clear_skb with pages, sets sgout to point to clear_skb pages
4. tls_do_decryption() starts async decryption (returns -EINPROGRESS via cryptd workqueue)
5. The clear_skb is placed on ctx->rx_list for later processing
6. tls_decrypt_async_wait() waits for async completion
7. tls_decrypt_done() is called from the workqueue → sees sgout != sgin → calls put_page() on clear_skb pages → pages freed while clear_skb still references them
8. On the next recv() call, process_rx_list() reads from the clear_skb → accesses freed pages → use-after-free

The fix (commit 32b55c5ff9103b8508c1e04bfa5a08c64e7a925f):

• Adds bool free_sgout to struct tls_decrypt_ctx
• Sets dctx->free_sgout = !!pages in tls_decrypt_sg() (only true when pages were actually allocated)
• Changes the check in tls_decrypt_done() from if (sgout != sgin) to if (dctx->free_sgout)

Fix commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=32b55c5ff9103b8508c1e04bfa5a08c64e7a925f

Reproduction Steps

1. Reference: bundle/repro/reproduction_steps.sh
2. What the script does:
   • Downloads Linux kernel v6.6.18 source
   • Applies GCC 15 compatibility patches (adds -std=gnu11 to REALMODE_CFLAGS, boot/compressed, and EFI libstub Makefiles)
   • Patches crypto/simd.c to force AEAD decrypt operations through the cryptd workqueue (simulating async crypto behavior that occurs with hardware crypto accelerators or in contexts where SIMD is unavailable)
   • Creates two kernel builds: vulnerable (fix reverted) and fixed (fix present)
   • Both builds include CONFIG_TLS=y, CONFIG_KASAN=y, CONFIG_CRYPTO_AES_NI_INTEL=y, CONFIG_PAGE_POISONING=y
   • Creates a minimal initramfs with a static kTLS test program that:
     • Establishes a loopback TCP connection
     • Configures kTLS with AES-128-GCM (TLS 1.2)
     • Sends 4096-byte records and performs partial reads (100 bytes then 3996 bytes)
     • Checks for data corruption
   • Boots both kernels in QEMU (TCG mode, -cpu max for AES-NI) with page_poison=1
   • Captures serial console output for KASAN reports and corruption detection
3. Expected evidence:
   • Vulnerable kernel: BUG: KASAN: use-after-free in copyout + Data MISMATCH - corruption detected! + BUG: Bad page state
   • Fixed kernel: No KASAN reports, no corruption, test completes normally

Evidence

• Vulnerable kernel log: bundle/logs/qemu-vuln-ktls.log
• Fixed kernel log: bundle/logs/qemu-fixed-ktls.log
• Reproduction script log: bundle/logs/reproduction_steps.log

Key excerpts from vulnerable kernel:

[    4.956611] BUG: KASAN: use-after-free in copyout+0x2d/0x50
[    4.957007] Read of size 100 at addr ff1100000186000d by task init/58
[    4.957072] Call Trace:
[    4.957072]  copyout+0x2d/0x50
[    4.957072]  _copy_to_iter+0x15b/0x1070
[    4.957072]  __skb_datagram_iter+0x3c7/0x890
[    4.957072]  skb_copy_datagram_iter+0x2f/0x120
[    4.957072]  process_rx_list+0x2b5/0x5f0
[    4.957072]  tls_sw_recvmsg+0x1081/0x17b0

[kTLS] Data MISMATCH - corruption detected!

[    4.969549] BUG: Bad page state in process init  pfn:02efc

Key excerpts from fixed kernel (negative control):

[kTLS] Data matches (no corruption observed yet)
[kTLS] Completed 20 iterations
[kTLS] Test complete. If KASAN is enabled, check dmesg for UAF report.

(No KASAN reports, no corruption, no bad page state)

Environment details:

• Kernel: Linux 6.6.18 (v6.6.18 with fix reverted for vulnerable, fix present for fixed)
• Compiler: GCC 15.2.0 with -std=gnu11 compatibility patches
• QEMU: QEMU 10.2.1, TCG mode, -cpu max (AES-NI emulation), 2 vCPUs, 1024MB RAM
• KASAN: Generic KASAN with inline instrumentation
• Page poisoning: enabled (page_poison=1)
• Crypto: AES-NI GCM with forced async decrypt via cryptd workqueue
• Test: kTLS AES-128-GCM, TLS 1.2, 4096-byte records, 100-byte partial reads

Recommendations / Next Steps

• Upgrade: Apply the fix (commit 32b55c5ff9103b8508c1e04bfa5a08c64e7a925f) or upgrade to Linux 6.6.19+, 6.7.7+, 6.1.82+, or 6.8-rc3+.
• Testing: Enable CONFIG_KASAN and CONFIG_PAGE_POISONING in kernel testing configurations to detect similar use-after-free bugs in the kTLS receive path.
• Code review: Audit other completion callbacks in the kTLS code that use pointer comparison (sgout != sgin) instead of explicit allocation tracking.
• Mitigation: If kTLS is used in production with hardware crypto accelerators (which naturally produce async completions), ensure the kernel is patched. The bug only manifests with async decryption, which is the normal case with hardware crypto.

Additional Notes

• Idempotency: The reproduction script is idempotent — it checks for existing build artifacts and reuses them. Running it multiple times produces the same result.
• Async path simulation: The crypto/simd.c patch forces AEAD decrypt operations through the cryptd workqueue, simulating the async behavior that occurs naturally with hardware crypto accelerators or in contexts where SIMD/FPU is unavailable (e.g., softirq context). This does not modify the vulnerable code path in tls_sw.c; it only ensures the async completion path is exercised. In production, this async path is triggered by hardware crypto offload or when the crypto operation is deferred.
• Page poisoning: CONFIG_PAGE_POISONING with page_poison=1 fills freed pages with a poison pattern (0xAA), making the use-after-free visible through data corruption even without KASAN. This provides an additional layer of detection beyond KASAN's shadow memory tracking.
• GCC 15 compatibility: The v6.6.18 kernel requires minor Makefile patches to build with GCC 15, which defaults to C23 where true/false are keywords. The patches add -std=gnu11 to REALMODE_CFLAGS, boot/compressed, and EFI libstub Makefiles, matching the fix applied in newer kernel versions.