keys RequestKeyAuth UAF

Vulnerability analysis

The vulnerability is a use-after-free race condition in the Linux kernel's request_key authentication mechanism. When a key helper process calls KEYCTL_INSTANTIATE_IOV, it loads the request_key_auth (rka) pointer from the auth key's payload and then may sleep on a page fault while copying the user-supplied payload. Concurrently, if the requesting process completes (e.g., times out or the helper finishes via another path), the auth key can be revoked and destroyed, freeing the rka structure. When the sleeping thread wakes up, it dereferences the now-freed rka->target_key, resulting in a use-after-free. The fix introduces a refcount (refcount_t usage) on the request_key_auth structure. The new request_key_auth_get() function takes the authkey->sem read lock, checks the KEY_FLAG_REVOKED flag, and atomically increments the refcount before releasing the lock. The corresponding request_key_auth_put() decrements the refcount and schedules RCU-based freeing only when the last reference is dropped. The revoke and destroy paths now call request_key_auth_put() instead of directly scheduling RCU disposal, ensuring the structure lives until all users have finished. The attack surface requires a local user who can call request_key() and KEYCTL_INSTANTIATE_IOV — available to any unprivileged process — and must win a race condition, making AC:High appropriate.