CVE-2023-53494

A flaw use after free in the Linux kernel XTS (XOR Encrypt XOR with ciphertext stealing) crypto Kernel module was found in the way privileges user triggers XTS crypto API in specific way. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

The patch fixes a use-after-free in the XTS skcipher template where -EBUSY from the crypto backend (with MAY_BACKLOG) was not treated like -EINPROGRESS, causing request data to be freed while still referenced. Impact is kernel memory corruption (high integrity/availability impact). For the CVSS the PR:L because triggering requires the ability to invoke kernel crypto operations (e.g., via AF_ALG skcipher XTS) and craft conditions that lead to a backlogged request. Note: In a standard Linux installation, this vulnerability can only be triggered by the root user, since access to the kernel crypto API (e.g., via AF_ALG sockets or device-mapper targets using XTS mode) requires CAP_SYS_ADMIN privileges. However, in specific environments such as containers or sandboxed setups where unprivileged users are granted CAP_SYS_ADMIN (or equivalent capabilities), a non-root user within that environment may also be able to exploit the issue. In hardened setups where AF_ALG is restricted, this path may be limited to privileged users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module xts from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.