Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the original

Impact

Cloning an IPTFS security association kmemdups the mode data, so the clone shares the original SA's skb queue, hrtimers, spinlock and in-flight reassembly state. If migration fails before re-init, destroying the clone splices and frees skbs still owned by the original SA - use-after-free and double-free of packet buffers belonging to a live encrypted association.

Who can reach it

Driven by XFRM_MSG_MIGRATE (or SA clone during migration) over xfrm netlink, requiring CAP_NET_ADMIN in the network namespace - available to the node's IKE daemon and to any container granted NET_ADMIN with its own netns. Conditional on IPTFS-mode SAs (RFC 9347 aggregation) being in use, and the corruption is most reachable when the SA has packets queued, which an attacker arranges by migrating under load.

What to do

Boot a kernel carrying the linked stable commits. Interim: avoid IPTFS mode SAs, do not run SA migration on nodes using IPTFS, and drop CAP_NET_ADMIN from tenant containers.

References