Bug 2425021 (CVE-2023-54046)

Summary: CVE-2023-54046 kernel: crypto: essiv - Handle EBUSY correctly
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A use-after-free vulnerability was found in the Linux kernel's ESSIV (Encrypted Salt-Sector Initialization Vector) crypto module. The essiv code only handles EINPROGRESS as a special return value, freeing request data for all other return codes. When callers use MAY_BACKLOG, an EBUSY return indicates the request was queued but will complete later. Freeing the data on EBUSY causes a use-after-free when the backlogged request completes.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-12-24 13:02:31 UTC 
In the Linux kernel, the following vulnerability has been resolved:

crypto: essiv - Handle EBUSY correctly

As it is essiv only handles the special return value of EINPROGERSS,
which means that in all other cases it will free data related to the
request.

However, as the caller of essiv may specify MAY_BACKLOG, we also need
to expect EBUSY and treat it in the same way.  Otherwise backlogged
requests will trigger a use-after-free.
Comment 1 Alexander B 2025-12-25 08:16:13 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025122423-CVE-2023-54046-aaf6@gregkh/T