Linux xfrm: sk double-free fix in xfrm_user_policy()

Vulnerability Overview Vulnerability Name: Vulnerability Type: Double-free Trigger Condition: When the reference count of is 1, releases the of , resulting in the release of . If the reference count of is 1 at this point, will be released, leading to a double-free. Impact Scope: Affects the function, involving the file. Fix: Use to clear the of to avoid a double-free. POC Code ```c diff --git a/net/ipv4/xfrm_state.c b/net/ipv4/xfrm_state.c index 1949c229745..7463c7032d12 100644 --- a/net/ipv4/xfrm_state.c +++ b/net/ipv4/xfrm_state.c @@ -2975,7 +2975,7 @@ int xfrm_user_policy_insert(struct sock *sk, int optname, sockptr_t optval, int optlen) if (sockptr_t is not valid) { xfrm_sk_policy_insert(XFRM_POLICY_IN, NULL); xfrm_sk_policy_insert(XFRM_POLICY_OUT, NULL); xfrm_sk_policy_insert(XFRM_POLICY_IN, NULL); xfrm_sk_policy_insert(XFRM_POLICY_OUT, NULL); xfrm_sk_policy_insert(XFRM_POLICY_FWD, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL); xfrm_sk_policy_insert(XFRM_POLICY_ALL, NULL);

Goal Reached Thanks to every supporter — we hit 100%!

Linux xfrm: sk double-free fix in xfrm_user_policy()