crypto/
├── algif_aead.c      ← インプレース scatterlist バグ（主）
└── authencesn.c      ← 範囲外スクラッチ書き込み（トリガー）

/* VULNERABLE — post-2017 in-place path */
static int aead_recvmsg(struct socket *sock, struct msghdr *msg,
                        size_t ignored, int flags)
{
    /* ... */

    /*
     * When userspace calls splice(2) on a file, areq->tsgl contains
     * page cache pages of that file. Setting dst = src hands those
     * page cache pages to the crypto engine as a writable output
     * buffer.
     */
    aead_request_set_crypt(req,
        areq->tsgl,   /* src */
        areq->tsgl,   /* dst — identical pointer; root cause */
        areq->cryptlen, iv);
}

/* crypto/authencesn.c — scratch write past output boundary */
static int crypto_authenc_esn_decrypt(struct aead_request *req)
{
    /* ... */

    /*
     * authencesn temporarily stores seqno_hi at offset
     * (assoclen + cryptlen) in req->dst — one word past the
     * legitimate output region.
     *
     * Under normal operation: hits kernel-owned memory.
     * With in-place scatterlist: hits a page cache page.
     */
    scatterwalk_map_and_copy(&seqno_hi,
        req->dst,
        req->assoclen + req->cryptlen,   /* out-of-bounds offset */
        sizeof(seqno_hi),                /* 4 bytes */
        1 /* write */);

    /* authencesn does not restore these bytes on the failing path */
}

/* FIXED — separate src and dst */
aead_request_set_crypt(req,
    areq->tsgl,   /* src — may contain page cache pages; read-only */
    areq->rsgl,   /* dst — freshly allocated kernel buffer; writable */
    areq->cryptlen, iv);

./scripts/get_maintainer.pl crypto/algif_aead.c
# Herbert Xu <[email protected]>
# [email protected]

./scripts/checkpatch.pl 0001-crypto-algif_aead-revert-inplace.patch

crypto: algif_aead - restore separate src/dst scatterlists in recvmsg

Commit 72548b093ee3 ("crypto: algif_aead - switch to in-place
processing") set req->src == req->dst inside aead_recvmsg(). When
the caller uses splice(2), the source scatterlist contains page
cache pages of the spliced file. With the in-place optimization,
those same pages become the writable destination passed to the
AEAD transform.

authencesn writes 4 bytes at offset (assoclen + cryptlen) into
req->dst as scratch space for Extended Sequence Number
rearrangement and does not restore them on the error path. With
page cache pages present in dst, this write bypasses the VFS
permission layer and corrupts the in-memory image of the spliced
file without modifying the on-disk inode.

An unprivileged local user can exploit this to overwrite
arbitrary bytes in the page cache of any readable setuid binary
and escalate privileges to root.

Restore separate src and dst scatterlists so that page cache
pages are confined to the read-only source path.

Fixes: 72548b093ee3 ("crypto: algif_aead - switch to in-place processing")
Cc: [email protected]  # 4.14+
Reported-by: Taeyang Lee <[email protected]>
Signed-off-by: Your Name <[email protected]>

git send-email \
  [email protected] \
  [email protected] \
  [email protected] \
  0001-crypto-algif_aead-revert-inplace.patch

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true