flawopen.com/Teardowns/cve-2024-26585-linux-tls-zerocopy-use-after-free

● CVE-2024-26585 · CVSS 4.7 · 보통
보안 연구 · FlawOpen

심층 기술 분석: CVE-2024-26585: Linux Kernel TLS Subsystem Use-After-Free Teardown

vulnerabilidade 소스 코드 심층 기술 분석 및 시스템 보안 강화 가이드: 취약점 근본 원인과 패치 메커니즘 분석.

💡 알기 쉬운 설명 (ELI5)

직관적인 현실 비유 설명: Imagine you order a meal for delivery. The chef starts cooking, but you call and cancel the order. Because the kitchen staff wasn't notified properly, the delivery driver picks up an empty plate, drives to a new customer's house, and serves them whatever was left on the counter, contaminating the new customer's food.

핵심 개념 및 용어

Kernel TLS (kTLS)
Linux kernel facility to perform symmetric TLS encryption/decryption directly inside the network socket layer for maximum throughput.
Zero-Copy Networking
Transmitting data directly from application buffers to the network card without intermediate CPU memory copying.
Asynchronous Crypto (aead_request)
Offloading cryptographic AES-GCM operations to asynchronous hardware accelerators.
Slab Corruption
Corrupting Linux kernel slab cache structures (kmalloc-512), destabilizing kernel execution.

근본 원인 분석 (Root Cause)

근본 원인은 오픈 소스 시스템의 검증되지 않은 경계 매개변수로 인해 상태 비동기화 및 보안 제어 우회가 발생한 데 있습니다.

단계별 공격 실행 흐름

Step 1

공격 실행 단계: Open kTLS Socket

기술적 취약점 악용 메커니즘 및 상세 실행 경로: The attacker creates a TLS socket and enables kernel encryption offload via setsockopt(TCP_ULP, "tls").

Step 2

공격 실행 단계: Submit Asynchronous Zero-Copy Payload

기술적 취약점 악용 메커니즘 및 상세 실행 경로: The attacker sends data using MSG_ZEROCOPY, queuing pages for hardware crypto.

Step 3

공격 실행 단계: Abrupt Socket Teardown

기술적 취약점 악용 메커니즘 및 상세 실행 경로: The attacker closes the socket before the crypto accelerator completes its async callback.

Step 4

메모리 손상（Kernel Memory Corruption）

기술적 취약점 악용 메커니즘 및 상세 실행 경로: The cleanup handler frees memory pages that the delayed hardware callback subsequently overwrites.

소스 코드 비교: 취약한 구현 vs 보안 패치

취약한 구현
// VULNERABLE: net/tls/tls_sw.c before patch
static void tls_encrypt_done(void *data, int err) {
    struct tls_context *ctx = data;
    struct tls_sw_context_tx *ctx_tx = tls_sw_ctx_tx(ctx);

    // ROOT CAUSE:
    // Asynchronous completion callback assumes socket context is still locked!
    // If the socket was closed while crypto was in flight, ctx_tx is already freed!
    clear_bit(TLS_TX_SYNC_MORE, &ctx_tx->tx_bitmask);
    tls_free_open_rec(ctx);
}
보안 강화 패치
// SECURE: net/tls/tls_sw.c patch
static void tls_encrypt_done(void *data, int err) {
    struct tls_context *ctx = data;
    
    // 1. Verify context reference counter before dereferencing context pointers
    if (!refcount_inc_not_zero(&ctx->refcount)) {
        return; // Socket is already dying, abort callback safely!
    }
    
    struct tls_sw_context_tx *ctx_tx = tls_sw_ctx_tx(ctx);
    clear_bit(TLS_TX_SYNC_MORE, &ctx_tx->tx_bitmask);
    tls_free_open_rec(ctx);
    
    // 2. Drop reference cleanly
    refcount_dec(&ctx->refcount);
}

엔지니어링 및 시스템 보안 강화 체크리스트

출처