CVE-2023-53799

Vulnerability

In the Linux kernel's crypto subsystem, the function crypto_destroy_instance could be called in atomic context when the last user of a crypto instance releases it. This violates the requirement of crypto_drop_spawn to be called in process context, leading to a potential use-after-free or other memory corruption [1].

Exploitation

An attacker would need to trigger the unregistration of a crypto instance while it still has active users. The final user's release operation, which may occur in atomic context (e.g., from a softirq a softirq or timer), would then invoke crypto_destroy_instance incorrectly. No special privileges or

Impact

Successful exploitation could allow an attacker to cause a kernel crash (denial of service) or potentially escalate privileges, depending on the memory layout and timing [1].

Mitigation

The fix, merged into the Linux kernel stable tree, defers the freeing of the instance to a work queue, ensuring that crypto_drop_spawn is always called in process context [1]. Users should apply the corresponding kernel update.