Skip to content

Commit f9e85b8

Browse files
committed
Merge: CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7100 JIRA: https://issues.redhat.com/browse/RHEL-102233 CVE: CVE-2025-38079 ``` commit b2df03e Author: Ivan Pravdin <ipravdin.official@gmail.com> Date: Sun May 18 18:41:02 2025 -0400 crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cd ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable@vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> ``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> --- <small>Created 2025-07-08 05:09 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Vladis Dronov <vdronov@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Augusto Caringi <acaringi@redhat.com>
2 parents f47e739 + d023d45 commit f9e85b8

File tree

1 file changed

+0
-4
lines changed

1 file changed

+0
-4
lines changed

crypto/algif_hash.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -263,10 +263,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock,
263263
return err;
264264

265265
err = crypto_ahash_import(&ctx2->req, state);
266-
if (err) {
267-
sock_orphan(sk2);
268-
sock_put(sk2);
269-
}
270266

271267
return err;
272268
}

0 commit comments

Comments
 (0)