Linux kernel (net/xfrm): Dumping SAs over xfrm netlink copies algorithm structures that were never fully initialized

Impact

Dumping SAs over xfrm netlink copies algorithm structures that were never fully initialized, so ~50 bytes of uninitialized kernel heap per algorithm are handed to userspace. That is a kernel-memory read primitive useful for defeating KASLR or recovering adjacent slab contents from inside a container.

Who can reach it

XFRM_MSG_GETSA dump over netlink, which needs CAP_NET_ADMIN in the network namespace - satisfied by any container granted NET_ADMIN with its own netns, and by the node's IKE daemon. The caller adds an SA (attach_auth allocates the buffer) and then dumps it back to read the uninitialized tail.

What to do

Boot a kernel carrying the linked stable commits. Interim: drop CAP_NET_ADMIN from tenant containers so the xfrm netlink dump surface is not exposed to them.

References