CVE-2023-54046

A use-after-free vulnerability was found in the Linux kernel's ESSIV (Encrypted Salt-Sector Initialization Vector) crypto module. The essiv code only handles EINPROGRESS as a special return value, freeing request data for all other return codes. When callers use MAY_BACKLOG, an EBUSY return indicates the request was queued but will complete later. Freeing the data on EBUSY causes a use-after-free when the backlogged request completes.

This flaw affects systems using ESSIV encryption mode with crypto operations that enable backlogging (MAY_BACKLOG). ESSIV is commonly used with dm-crypt for disk encryption. The use-after-free occurs when crypto hardware queues requests due to being busy, making this exploitable under high crypto workload conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.