CVE-2024-57982

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: state: fix out-of-bounds read during lookup

lookup and resize can run in parallel.

The xfrm_state_hash_generation seqlock ensures a retry, but the hash

functions can observe a hmask value that is too large for the new hlist

array.

rehash does:

rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..]

net->xfrm.state_hmask = nhashmask;

While state lookup does:

h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);

hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) {

This is only safe in case the update to state_bydst is larger than

net->xfrm.xfrm_state_hmask (or if the lookup function gets

serialized via state spinlock again).

Fix this by prefetching state_hmask and the associated pointers.

The xfrm_state_hash_generation seqlock retry will ensure that the pointer

and the hmask will be consistent.

The existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side,

add lockdep as

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References