Double-free of crypto_session on cryptoapi_cipher_setkey failure
Summary
dm_target_crypt.c:559-563 setkey fail -> cryptoapi_cipher_freesession(priv->crypto_session) at 563 but priv->crypto_session NOT set NULL. goto notsup. dm_table_destroy -> dm_target_crypt_destroy -> cryptoapi_cipher_freesession(priv->crypto_session) AGAIN at 637 -> double-free. Latent: current ciphers (aes/twofish/serpent) probe/setkey agree on key sizes so unreachable. Live when cipher added with divergent probe/setkey. Fix: priv->crypto_session=NULL after freesession at 563.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1637 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 348 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 719 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1637 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: dm_target_crypt.c:559-563 setkey fail -> cryptoapi_cipher_freesession(priv->crypto_session) at 563 but priv->crypto_session NOT set NULL. goto notsup. dm_table_destroy -> dm_target_crypt_destroy -> cr
Citation: sys/dev/disk/dm/crypt/dm_target_crypt.c:559-637
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: double-free of crypto_session on setkey fail (dm_target_crypt.c:559-563,637)
Verified recommended fix
Source-confirmed: double-free of crypto_session on setkey fail (dm_target_crypt.c:559-563,637)
Verdict
Source-confirmed: double-free of crypto_session on setkey fail (dm_target_crypt.c:559-563,637)
No comments yet.