CVE-2023-53536

A use-after-free vulnerability was found in the Linux kernel block layer crypto key management. When blk_crypto_evict_key() fails due to a key still being in-use or keyslot eviction failure during inode eviction, the function returns an error but leaves the key linked in keyslot management structures, causing the caller to free the blk_crypto_key structure regardless of the error, which results in a use-after-free when other code later accesses the freed key and can lead to memory corruption and denial of service.

The issue arises because of a mismatch between blk_crypto_evict_key()'s error handling and its callers' expectations. When evicting encryption keys during inode eviction or similar contexts, if blk_crypto_evict_key() detects that a key is still in-use or if the hardware keyslot_evict operation fails, it returns an error while leaving the key linked into the keyslot management lists and trees. However, callers like inode eviction treat failure as non-fatal and proceed to free the blk_crypto_key memory regardless of the return value, since in these contexts failure is not an option. This creates a window where the management structures contain pointers to freed memory. When blk_crypto_reprogram_all_keys() or other functions later traverse these structures, they dereference freed memory, causing use-after-free conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.