Linux kernel (net/xfrm): SA lookup can observe the new hash mask before the new bucket array is published, so it

CVSS 7.8CVE-2024-57982Kernel, userspace & hypervisorcurated

Impact

SA lookup can observe the new hash mask before the new bucket array is published, so it indexes past the end of the old table - an out-of-bounds read in the code path that decides which security association handles a packet. Besides the read, a lookup that lands in garbage can miss or mismatch the SA for in-flight traffic.

Who can reach it

Driven by packet processing on any IPsec-enabled node while the state table is resized. The resize happens as SAs are added, i.e. as tenants' IPsec tunnels come and go, so the race window opens during normal churn on a per-tenant encrypted overlay. Anyone who can cause SA creation (the IKE daemon, or a container with CAP_NET_ADMIN in its netns) can force the rehash on demand.

What to do

Boot a kernel carrying the linked stable commits. Interim: pre-size the xfrm state hash where possible and avoid rapid SA churn; drop CAP_NET_ADMIN from tenant containers so they cannot force rehashing.

References

https://git.kernel.org/stable/c/b86dc510308d7a8955f3f47a4fea4bef887653e4 https://git.kernel.org/stable/c/a16871c7832ea6435abb6e0b58289ae7dcb7e4fc https://nvd.nist.gov/vuln/detail/CVE-2024-57982

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.