● CVE-2024-26584 / High Severity

CVE-2024-26584: Linux Kernel TLS Subsystem Use-After-Free Teardown

How an asynchronous cryptographic callback race condition in net/tls/tls_sw.c freed network pages while still queued for zero-copy transmission.

💡 通俗通俗化解析 (ELI5)

Imagine you order a meal for delivery. The chef starts cooking, but you call and cancel the order. Because the kitchen staff wasn't notified properly, the delivery driver picks up an empty plate, drives to a new customer's house, and serves them whatever was left on the counter, contaminating the new customer's food.

核心概念与底层架构术语

Kernel TLS (kTLS): Linux kernel facility to perform symmetric TLS encryption/decryption directly inside the network socket layer for maximum throughput.
Zero-Copy Networking: Transmitting data directly from application buffers to the network card without intermediate CPU memory copying.
Asynchronous Crypto (aead_request): Offloading cryptographic AES-GCM operations to asynchronous hardware accelerators.
Slab Corruption: Corrupting Linux kernel slab cache structures (`kmalloc-512`), destabilizing kernel execution.

攻击利用全流程逐步拆解

Step 1

1. Open kTLS Socket

The attacker creates a TLS socket and enables kernel encryption offload via setsockopt(TCP_ULP, "tls").

Step 2

2. Submit Asynchronous Zero-Copy Payload

The attacker sends data using MSG_ZEROCOPY, queuing pages for hardware crypto.

Step 3

3. Abrupt Socket Teardown

The attacker closes the socket before the crypto accelerator completes its async callback.

Step 4

4. Kernel Memory Corruption

The cleanup handler frees memory pages that the delayed hardware callback subsequently overwrites.

源码对比：致命缺陷 vs. 加固补丁

采用清晰易读的高级编程语言展示（不含晦涩汇编或二进制机器码）。

未修补缺陷代码

// VULNERABLE: net/tls/tls_sw.c before patch
static void tls_encrypt_done(void *data, int err) {
    struct tls_context *ctx = data;
    struct tls_sw_context_tx *ctx_tx = tls_sw_ctx_tx(ctx);

    // ROOT CAUSE:
    // Asynchronous completion callback assumes socket context is still locked!
    // If the socket was closed while crypto was in flight, ctx_tx is already freed!
    clear_bit(TLS_TX_SYNC_MORE, &ctx_tx->tx_bitmask);
    tls_free_open_rec(ctx);
}

安全加固补丁

// SECURE: net/tls/tls_sw.c patch
static void tls_encrypt_done(void *data, int err) {
    struct tls_context *ctx = data;
    
    // 1. Verify context reference counter before dereferencing context pointers
    if (!refcount_inc_not_zero(&ctx->refcount)) {
        return; // Socket is already dying, abort callback safely!
    }
    
    struct tls_sw_context_tx *ctx_tx = tls_sw_ctx_tx(ctx);
    clear_bit(TLS_TX_SYNC_MORE, &ctx_tx->tx_bitmask);
    tls_free_open_rec(ctx);
    
    // 2. Drop reference cleanly
    refcount_dec(&ctx->refcount);
}

工程落地与系统加固清单

Use `refcount_inc_not_zero()` on shared context handles inside asynchronous completion handlers.
Synchronously drain or cancel all in-flight asynchronous hardware crypto jobs before releasing socket memory.
Verify thread-safety and lock ownership inside callback routines.
Audit zero-copy socket implementations for lifetime and reference races.

← 浏览完整安全目录所有平台安全更新 →