Description

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_skcipher - force synchronous processing on trees without ctx->state The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv directly into the skcipher request. After io_submit() the socket lock is dropped and the request is processed asynchronously, so a concurrent sendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request run under an attacker-controlled IV. For CTR/stream modes this is IV/keystream reuse and lets an unprivileged user recover the plaintext of a concurrent operation. Snapshotting ctx->iv into per-request storage for the async path is not sufficient. For ciphers with statesize == 0 - which includes cbc and ctr - the MSG_MORE inter-chunk IV chaining is carried solely by the in-place req->iv writeback, which a snapshot redirects into per-request memory that af_alg_free_resources() releases on completion, silently producing wrong output. Writing the IV back from the completion callback instead is not possible either: that would require lock_sock() there, but the callback can run in softirq/atomic context, so it must not sleep. Make the operation synchronous instead, which removes both the IV race and any writeback race. This is equivalent to the upstream resolution, commit fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the AIO socket path across net/ entirely and so produces the same end state for this file. This patch deviates from that commit deliberately: rather than removing AIO socket support tree-wide, which would be far too invasive for stable, it removes only the AIO branch in crypto/algif_skcipher.c. io_submit() now completes synchronously; AF_ALG async is rarely used in practice. The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless, and is left alone to keep the fix minimal. Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000 after the change; MSG_MORE chunked CTR output bit-identical to single-shot.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-16T09:16:21.653Z",
  "pubdate": "2026-08-16T09:16:21.653Z",
  "executiveSummary": "A race condition vulnerability exists in the Linux kernel cryptographic subsystem, specifically within the crypto: algif_skcipher component handling symmetric key ciphers via AF_ALG sockets. The flaw arises from asynchronous processing (AIO/async path) in skcipher_recvmsg() where the socket-wide initialization vector (ctx->iv) is passed directly into the skcipher request without adequate isolation or synchronization.\nAn unprivileged local attacker can exploit this vulnerability by issuing concurrent sendmsg(ALG_SET_IV) system calls during an in-flight asynchronous operation. This allows the attacker to overwrite the shared ctx->iv while the request is being processed asynchronously.\nThe primary impact of this vulnerability is IV and keystream reuse in sensitive cryptographic modes such as CTR and stream ciphers, enabling the recovery of plaintext from concurrent cryptographic operations. The affected systems include Linux kernel environments utilizing the AF_ALG user-space cryptographic interface supporting asynchronous cipher operations.\nExploitation requires local access to the system and the ability to execute code that interacts with AF_ALG sockets, but does not require elevated privileges or authentication. Remediation requires applying the kernel patch that forces synchronous processing for affected trees, thereby eliminating the underlying race condition.",
  "technicalDetails": "The vulnerability resides in the Linux kernel file crypto/algif_skcipher.c, specifically within the asynchronous execution path managed by skcipher_recvmsg().\nRoot Cause: The asynchronous processing path passes the socket-wide context initialization vector (ctx->iv) directly into the underlying skcipher request. When io_submit() is invoked, the socket lock is dropped, allowing the request to proceed asynchronously. Because the socket lock is released, a concurrent sendmsg(ALG_SET_IV) system call can modify ctx->iv mid-operation. Consequently, the in-flight request executes under an attacker-controlled IV.\nFurthermore, snapshotting ctx->iv into per-request storage is insufficient for ciphers with a statesize of zero (such as CBC and CTR modes). In these modes, MSG_MORE inter-chunk IV chaining relies strictly on the in-place req->iv writeback. A snapshot redirects this writeback into per-request memory that af_alg_free_resources() releases upon completion, leading to corrupted output. Writing the IV back from the asynchronous completion callback is structurally impossible because the callback executes in softirq or atomic context where sleeping is prohibited, preventing the acquisition of lock_sock().\nAttack Flow and Step-by-Step Exploitation:\n1. An unprivileged attacker establishes an AF_ALG socket and configures a symmetric cipher utilizing vulnerable modes such as CTR or stream ciphers.\n2. The attacker initiates an asynchronous decryption or encryption request using the AIO path via skcipher_recvmsg(), which passes a reference to the shared socket-wide ctx->iv.\n3. Following io_submit(), the kernel drops the socket lock while the request is processed asynchronously in the background.\n4. The attacker immediately issues a concurrent sendmsg(ALG_SET_IV) system call on the same socket to overwrite ctx->iv with a malicious or predictable value.\n5. The active cryptographic operation processes using the attacker-controlled IV, resulting in IV/keystream reuse.\n6. The attacker analyzes the resulting ciphertext or plaintext to recover sensitive data from concurrent cryptographic operations.\nVulnerable Component: crypto/algif_skcipher.c (specifically the asynchronous processing path in skcipher_recvmsg()).\nPrivilege Requirements: Unprivileged local user space access.\nAuthentication Requirements: None beyond the ability to open AF_ALG sockets."
}