Technical Root Cause Analysis

1. Involved Files, Functions, Structs, and Fields

• Source File: drivers/md/dm-crypt.c
• Functions:
  • crypt_ctr_optional()
  • crypt_ctr_cipher_new()
  • crypt_ctr_auth_cipher()
  • crypt_integrity_hmac()
  • crypt_setkey()
  • crypt_copy_authenckey()
• Structs & Fields:
  • struct crypt_config: cc->authenc_key (pointer to the buffer formatted for crypto_authenc keys), cc->key_mac_size (size of the authentication key), cc->cipher_flags (tracking CRYPT_MODE_INTEGRITY_AEAD and CRYPT_KEY_MAC_SIZE_SET).
  • struct crypto_authenc_key_param: param->enckeylen.

2. Trigger Mechanism and Violated Invariants

In drivers/md/dm-crypt.c, dm-crypt supports two styles of AEAD (Authenticated Encryption with Associated Data):

1. Composite AEAD algorithms using the authenc(...) crypto API template (such as authenc(hmac(sha256),xts(aes))). For authenc, the key format requires prepending a struct crypto_authenc_key_param rtattr header before the auth and cipher keys via crypt_copy_authenckey(), storing the result in cc->authenc_key.
2. Direct / native AEAD algorithms (such as rfc7539(chacha20,poly1305) or gcm(aes)), which take a single flat key directly via crypto_aead_setkey() and do not use authenc_key or crypt_copy_authenckey().

The bug occurs during table initialization in crypt_ctr():

1. crypt_ctr_optional() parses optional table constructor arguments before the cipher itself is initialized. When the parameters integrity:<tag_size>:aead and integrity_key_size:<mac_size> are provided:
   • CRYPT_MODE_INTEGRITY_AEAD is set on cc->cipher_flags.
   • cc->key_mac_size is assigned the specified value (e.g., 32), and CRYPT_KEY_MAC_SIZE_SET is set on cc->cipher_flags.
2. crypt_ctr_cipher() is called next, which invokes crypt_ctr_cipher_new(). Since AEAD mode is enabled, crypt_ctr_cipher_new() invokes crypt_ctr_auth_cipher(cc, cipher_api).
3. In crypt_ctr_auth_cipher():

   if (!strstarts(cipher_api, "authenc("))
       return 0;
   

   If the user-specified cipher is a native AEAD cipher (e.g., capi:rfc7539(chacha20,poly1305)-random), it does not start with "authenc(". As a result, crypt_ctr_auth_cipher() immediately returns 0 without allocating cc->authenc_key (cc->authenc_key remains NULL).
4. Later in table construction, crypt_setkey(cc) is invoked to configure the encryption/auth keys. It checks whether HMAC formatting is required using crypt_integrity_hmac(cc):

   static bool crypt_integrity_hmac(struct crypt_config *cc)
   {
       return crypt_integrity_aead(cc) && cc->key_mac_size;
   }
   

   Because integrity_key_size: was passed, cc->key_mac_size is non-zero, and crypt_integrity_aead(cc) is true. Therefore, crypt_integrity_hmac(cc) returns true even though the cipher is NOT an authenc composite algorithm and cc->authenc_key was never allocated.
5. In crypt_setkey(cc):

   if (crypt_integrity_hmac(cc)) {
       ...
       crypt_copy_authenckey(cc->authenc_key, cc->key,
                             subkey_size - cc->key_mac_size,
                             cc->key_mac_size);
   }
   

   crypt_copy_authenckey() is called with p = cc->authenc_key (NULL):

   static void crypt_copy_authenckey(char *p, const void *key,
                                     unsigned int enckeylen, unsigned int authkeylen)
   {
       struct crypto_authenc_key_param *param;
       struct rtattr *rta;
   
       rta = (struct rtattr *)p;
       param = RTA_DATA(rta);
       param->enckeylen = cpu_to_be32(enckeylen);
       ...
   }
   

   RTA_DATA(0) resolves to (void *)(0 + 4) = 0x4. The function attempts to write to param->enckeylen at address 0x0000000000000004, triggering a NULL pointer dereference.

3. Production Kernel Impact and Classification Rationale

• MemoryCorruption: false The fault is a pure NULL pointer dereference (param->enckeylen at address 0x4). In a production kernel without KASAN, the write to address 0x4 in kernel space triggers an unhandled page fault (#PF) and immediately halts kernel execution via an oops/panic. No valid kernel objects or arbitrary memory addresses are overwritten. Under the classification criteria, pure NULL-pointer dereferences (including accesses to KASAN shadow memory for NULL around 0xdffffc0000000000) do not count as memory corruption.
• InfoLeak: "none" The operation crashes during table loading prior to any output or data read path. No kernel memory is copied or exposed to userspace.
• RawDenialOfService: true Any user process with permission to configure device-mapper targets (e.g. root or processes with CAP_SYS_ADMIN) can issue a DM_TABLE_LOAD ioctl with these parameters, triggering an unhandled kernel paging request and immediate kernel panic / system crash.
• IsNetCandidate: false The bug is in the Device Mapper crypt target (dm-crypt), part of the block/crypto subsystems, with no networking components involved.
• IsKVMCandidate: false The defect is unrelated to KVM, hypervisors, or virtualization interfaces.