crypto/
├── algif_aead.c      ← In-Place-Scatterlist-Fehler (primär)
└── authencesn.c      ← Out-of-Bounds-Scratch-Schreibvorgang (Auslöser)

/* VERWUNDBAR — In-Place-Pfad nach 2017 */
static int aead_recvmsg(struct socket *sock, struct msghdr *msg,
                        size_t ignored, int flags)
{
    /* ... */

    /*
     * Wenn Userspace splice(2) auf einer Datei aufruft, enthält areq->tsgl
     * Page-Cache-Seiten dieser Datei. Das Setzen von dst = src übergibt
     * diese Page-Cache-Seiten der Crypto-Engine als beschreibbaren
     * Ausgabepuffer.
     */
    aead_request_set_crypt(req,
        areq->tsgl,   /* src */
        areq->tsgl,   /* dst — identischer Zeiger; Grundursache */
        areq->cryptlen, iv);
}

/* crypto/authencesn.c — Scratch-Schreibvorgang über die Ausgabegrenze hinaus */
static int crypto_authenc_esn_decrypt(struct aead_request *req)
{
    /* ... */

    /*
     * authencesn speichert seqno_hi vorübergehend am Offset
     * (assoclen + cryptlen) in req->dst — ein Wort hinter der
     * legitimen Ausgaberegion.
     *
     * Unter normalem Betrieb: trifft Kernel-eigenen Speicher.
     * Mit In-Place-Scatterlist: trifft eine Page-Cache-Seite.
     */
    scatterwalk_map_and_copy(&seqno_hi,
        req->dst,
        req->assoclen + req->cryptlen,   /* Out-of-Bounds-Offset */
        sizeof(seqno_hi),                /* 4 Bytes */
        1 /* write */);

    /* authencesn stellt diese Bytes auf dem Fehlerpfad nicht wieder her */
}

/* BEHOBEN — getrennte src und dst */
aead_request_set_crypt(req,
    areq->tsgl,   /* src — kann Page-Cache-Seiten enthalten; schreibgeschützt */
    areq->rsgl,   /* dst — frisch zugewiesener Kernel-Puffer; beschreibbar */
    areq->cryptlen, iv);

./scripts/get_maintainer.pl crypto/algif_aead.c
# Herbert Xu <[email protected]>
# [email protected]

./scripts/checkpatch.pl 0001-crypto-algif_aead-revert-inplace.patch

crypto: algif_aead - restore separate src/dst scatterlists in recvmsg

Commit 72548b093ee3 ("crypto: algif_aead - switch to in-place
processing") set req->src == req->dst inside aead_recvmsg(). When
the caller uses splice(2), the source scatterlist contains page
cache pages of the spliced file. With the in-place optimization,
those same pages become the writable destination passed to the
AEAD transform.

authencesn writes 4 bytes at offset (assoclen + cryptlen) into
req->dst as scratch space for Extended Sequence Number
rearrangement and does not restore them on the error path. With
page cache pages present in dst, this write bypasses the VFS
permission layer and corrupts the in-memory image of the spliced
file without modifying the on-disk inode.

An unprivileged local user can exploit this to overwrite
arbitrary bytes in the page cache of any readable setuid binary
and escalate privileges to root.

Restore separate src and dst scatterlists so that page cache
pages are confined to the read-only source path.

Fixes: 72548b093ee3 ("crypto: algif_aead - switch to in-place processing")
Cc: [email protected]  # 4.14+
Reported-by: Taeyang Lee <[email protected]>
Signed-off-by: Your Name <[email protected]>

git send-email \
  [email protected] \
  [email protected] \
  [email protected] \
  0001-crypto-algif_aead-revert-inplace.patch

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true