keys Keyring UAF

Vulnerability analysis

The vulnerability is a use-after-free (or access to freed memory) in find_key_to_update() in security/keys/keyring.c. The function calls assoc_array_find() to look up a key in the keyring's associative array without holding the RCU read lock. The assoc_array_gc() garbage collection code is designed to remove nodes from the tree and then free them after an RCU grace period — this design assumes that any concurrent reader holds the RCU read lock to prevent the grace period from completing while the node is in use. For regular key operations, the keyring semaphore is held, which incidentally prevents concurrent GC from freeing the node. However, the persistent key handling path does not hold the keyring semaphore, so there is no protection against concurrent GC freeing the node while assoc_array_find() is traversing it. The fix is a single line: adding guard(rcu)() before the assoc_array_find() call to acquire the RCU read lock for the duration of the lookup, which is exactly what the assoc_array infrastructure was designed to require.