CVE: CVE-2023-54170
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

keys: Fix linking a duplicate key to a keyring's assoc_array

When making a DNS query inside the kernel using dns_query(), the request
code can in rare cases end up creating a duplicate index key in the
assoc_array of the destination keyring. It is eventually found by
a BUG_ON() check in the assoc_array implementation and results in
a crash.

Example report:
[2[PII_REDACTED]25] kernel BUG at ../lib/assoc_array.c:652!
[2[PII_REDACTED]39] invalid opcode: 0000 [#1] SMP PTI
[2[PII_REDACTED]65] CPU: 3 PID: 31985 Comm: kworker/3:1 Kdump: loaded Not tainted 5.3.18-150300.59.90-default #1 SLE15-SP3
[2[PII_REDACTED]96] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
[2[PII_REDACTED]51] Workqueue: cifsiod cifs_resolve_server [cifs]
[2[PII_REDACTED]80] RIP: 0010:assoc_array_insert+0x85f/0xa40
[2[PII_REDACTED]01] Code: ff 74 2b 48 8b 3b 49 8b 45 18 4c 89 e6 48 83 e7 fe e8 95 ec 74 00 3b 45 88 7d db 85 c0 79 d4 0f 0b 0f 0b 0f 0b e8 41 f2 be ff <0f> 0b 0f 0b 81 7d 88 ff ff ff 7f 4c 89 eb 4c 8b ad 58 ff ff ff 0f
[2[PII_REDACTED]48] RSP: 0018:ffffc0bd6187faf0 EFLAGS: 00010282
[2[PII_REDACTED]70] RAX: ffff9f1ea7da2fe8 RBX: ffff9f1ea7da2fc1 RCX: [PII_REDACTED]
[2[PII_REDACTED]92] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
[2[PII_REDACTED]15] RBP: ffffc0bd6187fbb0 R08: ffff9f185faf1100 R09: [PII_REDACTED]
[2[PII_REDACTED]38] R10: ffff9f1ea7da2cc0 R11: 000000005ed8cec8 R12: ffffc0bd6187fc28
[2[PII_REDACTED]61] R13: ffff9f15feb8d000 R14: ffff9f1ea7da2fc0 R15: ffff9f168dc0d740
[2[PII_REDACTED]85] FS:  [PII_REDACTED](0000) GS:ffff9f185fac0000(0000) knlGS:[PII_REDACTED]
[2[PII_REDACTED]10] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[2[PII_REDACTED]30] CR2: 00007fdd94fca238 CR3:[PII_REDACTED]d8c006 CR4:[PII_REDACTED]3706e0
[2[PII_REDACTED]02] Call Trace:
[2[PII_REDACTED]41]  ? key_alloc+0x447/0x4b0
[2[PII_REDACTED]68]  ? __key_link_begin+0x43/0xa0
[2[PII_REDACTED]90]  __key_link_begin+0x43/0xa0
[2[PII_REDACTED]14]  request_key_and_link+0x2c7/0x730
[2[PII_REDACTED]47]  ? dns_resolver_read+0x20/0x20 [dns_resolver]
[2[PII_REDACTED]73]  ? key_default_cmp+0x20/0x20
[2[PII_REDACTED]98]  request_key_tag+0x43/0xa0
[2[PII_REDACTED]26]  dns_query+0x114/0x2ca [dns_resolver]
[2[PII_REDACTED]27]  dns_resolve_server_name_to_ip+0x194/0x310 [cifs]
[2[PII_REDACTED]64]  ? scnprintf+0x49/0x90
[2[PII_REDACTED]90]  ? __switch_to_asm+0x40/0x70
[2[PII_REDACTED]11]  ? __switch_to_asm+0x34/0x70
[2[PII_REDACTED]05]  reconn_set_ipaddr_from_hostname+0x81/0x2a0 [cifs]
[2[PII_REDACTED]03]  cifs_resolve_server+0x4b/0xd0 [cifs]
[2[PII_REDACTED]32]  process_one_work+0x1f8/0x3e0
[2[PII_REDACTED]58]  worker_thread+0x2d/0x3f0
[2[PII_REDACTED]82]  ? process_one_work+0x3e0/0x3e0
[2[PII_REDACTED]03]  kthread+0x10d/0x130
[2[PII_REDACTED]23]  ? kthread_park+0xb0/0xb0
[2[PII_REDACTED]46]  ret_from_fork+0x1f/0x40

The situation occurs as follows:
* Some kernel facility invokes dns_query() to resolve a hostname, for
  example, "abcdef". The function registers its global DNS resolver
  cache as current->cred.thread_keyring and passes the query to
  request_key_net() -> request_key_tag() -> request_key_and_link().
* Function request_key_and_link() creates a keyring_search_context
  object. Its match_data.cmp method gets set via a call to
  type->match_preparse() (resolves to dns_resolver_match_preparse()) to
  dns_resolver_cmp().
* Function request_key_and_link() continues and invokes
  search_process_keyrings_rcu() which returns that a given key was not
  found. The control is then passed to request_key_and_link() ->
  construct_alloc_key().
* Concurrently to that, a second task similarly makes a DNS query for
  "abcdef." and its result gets inserted into the DNS resolver cache.
* Back on the first task, function construct_alloc_key() first runs
  __key_link_begin() to determine an assoc_array_edit operation to
  insert a new key. Index keys in the array are compared exactly as-is,
  using keyring_compare_object(). The operation 
---truncated---
References: https://git.kernel.org/stable/c/00edfa6d4fe022942e2f2e6f3294ff13ef78b15c; https://git.kernel.org/stable/c/0a6b0ca58685be34979236f83f2b322635b80b32; https://git.kernel.org/stable/c/65bd66a794bfa059375ec834885bb610d75c0182