CVE-2023-52854

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

padata: Fix refcnt handling in padata_free_shell()

In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead

to system UAF (Use-After-Free) issues. Due to the lengthy analysis of

the pcrypt_aead01 function call, I'll describe the problem scenario

using a simplified model:

Suppose there's a user of padata named `user_function` that adheres to

the padata requirement of calling `padata_free_shell` after `serial()`

has been invoked, as demonstrated in the following code:

```c

struct request {

struct padata_priv padata;

struct completion *done;

};

void parallel(struct padata_priv *padata) {

do_something();

}

void serial(struct padata_priv *padata) {

struct request *request = container_of(padata,

struct request,

padata);

complete(request->done);

}

void user_function() {

DECLARE_COMPLETION(done)

padata->parallel = parallel;

padata->serial = serial;

padata_d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References