In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix dev use-after-free in xfrm async resumption
xfrm async resumption hold skb->dev refcnt until after transport_finish.
However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking
device reference, such as vti_rcv_cb. The subsequent async resumption
will decrement the tunnel device's reference count, which lead to uaf
of tunnel dev and refcnt leak of orig dev as below:
unregister_netdevice: waiting for vti1 to become free. Usage count = -2
Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set
by xfrm_rcv_cb can race with device teardown. Extend rcu protection over
xfrm_rcv_cb and transport_finish to prevent races.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - Reachable from the network receive path: remote ESP/AH (or UDP-encapsulated IPsec) packets hit ip_rcv → xfrm4/xfrm6 protocol handlers → vti/xfrmi input → xfrm_input() → async crypto resume, on Internet-facing IPsec/VTI/xfrmi VPN gateways and cloud endpoints.
AC:L - Once async decryption resumes (encap_type=-1), vti_rcv_cb/xfrmi_rcv_cb retarget skb->dev and the stale dev_put is deterministic; the attacker controls packet rate/volume to drive -EINPROGRESS and can race netdev teardown, so no uncontrollable victim-only conditions apply.
PR:N - No local account, shell, or capability on the victim is required—only network-delivered IPsec traffic accepted by a pre-configured VTI/xfrmi gateway (e.g., VPN peer, site-to-site endpoint); administrative IPsec setup is deployment state, not attacker privilege on the host.
UI:N - Exploitation is fully automated by sending IPsec packets; no victim interaction such as mounting filesystems, opening files, or clicking links is needed.
S:U - Impact is kernel net_device refcount corruption/UAF within the host kernel security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel privilege escalation, not escape).
C:H - Use-after-free of a net_device after refcount underflow (e.g., usage count=-2) exposes freed netdev/slab memory; per kernel UAF guidance this provides a high-impact arbitrary-read primitive via heap grooming.
I:H - Corrupting freed net_device structures and reference counts is classic heap UAF that can be shaped into arbitrary kernel writes and control-flow hijack for code execution, per kernel memory-corruption guidance.
A:H - Refcount imbalance causes unregister_netdevice to hang (usage count=-2), kernel oops/panic during tunnel teardown, and reliable denial of service on IPsec gateways even before full exploitation.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - Reachable from the network receive path: remote ESP/AH (or UDP-encapsulated IPsec) packets hit ip_rcv → xfrm4/xfrm6 protocol handlers → vti/xfrmi input → xfrm_input() → async crypto resume, on Internet-facing IPsec/VTI/xfrmi VPN gateways and cloud endpoints.
AC:L - Once async decryption resumes (encap_type=-1), vti_rcv_cb/xfrmi_rcv_cb retarget skb->dev and the stale dev_put is deterministic; the attacker controls packet rate/volume to drive -EINPROGRESS and can race netdev teardown, so no uncontrollable victim-only conditions apply.
PR:N - No local account, shell, or capability on the victim is required—only network-delivered IPsec traffic accepted by a pre-configured VTI/xfrmi gateway (e.g., VPN peer, site-to-site endpoint); administrative IPsec setup is deployment state, not attacker privilege on the host.
UI:N - Exploitation is fully automated by sending IPsec packets; no victim interaction such as mounting filesystems, opening files, or clicking links is needed.
S:U - Impact is kernel net_device refcount corruption/UAF within the host kernel security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel privilege escalation, not escape).
C:H - Use-after-free of a net_device after refcount underflow (e.g., usage count=-2) exposes freed netdev/slab memory; per kernel UAF guidance this provides a high-impact arbitrary-read primitive via heap grooming.
I:H - Corrupting freed net_device structures and reference counts is classic heap UAF that can be shaped into arbitrary kernel writes and control-flow hijack for code execution, per kernel memory-corruption guidance.
A:H - Refcount imbalance causes unregister_netdevice to hang (usage count=-2), kernel oops/panic during tunnel teardown, and reliable denial of service on IPsec gateways even before full exploitation.
CVSS 3.1