Linux Kernel Network Security -
Transport Layer Security (TLS)
Deep Hacking
2025/01/19 Pumpkin 🎃
1
Outline
• Overview
• Vulnerability
2
Overview
3
Overview
4
https://blog.salrashid.dev/articles/2022/kernel_tls/
Overview
tcp_prot
IPPROTO_TCP Protocol
(struct proto)
inet_stream_ops
SOCK_STREAM Type
(struct proto_ops)
inet_family_ops
AF_INET Family
(struct net_proto_family)
5
Overview
TLS ULP (Upper Level Protocol)
tcp_prot
IPPROTO_TCP Protocol
(struct proto)
inet_stream_ops
SOCK_STREAM Type
(struct proto_ops)
inet_family_ops
AF_INET Family
(struct net_proto_family)
6
Overview
TLS ULP (Upper Level Protocol)
tls_prots
tcp_prot
IPPROTO_TCP Protocol
(struct proto)
inet_stream_ops
tls_proto_ops
SOCK_STREAM Type
(struct proto_ops)
inet_family_ops
AF_INET Family
(struct net_proto_family)
7
sk_proto tcp_prot
tx_lock
sk
struct tls_context
(ULP) tls_prots [TLS_NUM_PROTS] [TLS_NUM_CONFIG] [TLS_NUM_CONFIG]
icsk->icsk_ulp_data TX RX
TLS_BASE TLS_BASE
sk_prot
IPv4
sk_socket
X TLS_SW X TLS_SW
struct sock
(Protocol) IPv6
TLS_HW TLS_HW
sk
ops tls_proto_ops [TLS_NUM_PROTS] [TLS_NUM_CONFIG] [TLS_NUM_CONFIG]
struct socket
(Type)
8
Overview
cipher type AES_GCM_128
TLS vers. TLS_1_2
struct KEY 0123…DEF
tls_sw_context_tx IV 12345678
SALT SALT
… …
struct tls_context
cipher type …
TLS vers. …
KEY …
struct
IV …
tls_sw_context_rx
SALT …
… …
9
Overview
10
Overview
Send packets
Encrypt packets
on TCP
TLS socket
Receive packets
Decrypt packets
on TCP
11
Overview
Send packets
Encrypt packets
on TCP
TLS socket
Receive packets
Decrypt packets
on TCP
12
Overview
• Supported TLS algorithms
• gcm(aes)
• ccm(aes)
• gcm(sm4)
• …
13
Overview
• Supported TLS algorithms
• gcm(aes)
• ccm(aes)
• gcm(sm4)
• … Template name
14
Overview
• Supported TLS algorithms
• gcm(aes)
• ccm(aes)
• gcm(sm4)
• … Cipher name
15
Overview
• Algorithm
• Implementation of a speci c cryptographic operation, such as AES,
SHA-256, or HMAC
• Template
• Constructing more complex cryptographic transformations by combining or
layering simpler algorithms
16
fi
Overview
• Instance
• Instantiation of a cryptographic template, where speci c algorithms and
parameters have been con gured
• Spawn
• Create a linkage or dependency between cryptographic instances and
algorithms
17
fi
fi
Built-in Created
Algorithm aes md5 sha256 … ctr(aes) gcm(aes)
Template ctr ecb cbc …
A created algorithm is a part of instance
ctr templ gcm templ
Instance instance instance
Spawn
Built-in Created
Algorithm aes md5 sha256 … ctr(aes) gcm(aes)
Template ctr ecb cbc …
A
ctr templ gcm templ
Instance instance instance
Spawn the instance if a dependency exists
…
inst.alg
(struct aead_alg)
inst.alg.base
(struct crypto_alg)
cra_name[ ] “gcm(aes)”
cra_driver_name[ ] “gcm_base(ctr(aes-
generic),ghash-generic)”
cra_list
instances
cra_ ags
crypto_gcm_tmpls
(struct crypto_template)
list
aead_crypto_instance(inst) struct aead_instance crypto_alg_list
(struct crypto_instance) (struct list_head)
20
fl
Overview
• For example, if we con gure “gcm(aes)” as the crypto algorithm of TX…
21
fi
Thread-A Thread-B
Find “gcm(aes)”
aes
md5
Global variable
22
Thread-A Thread-B
Not found
Find “gcm(aes)”
aes
md5
Global variable
23
Thread-A Thread-B
Find “gcm(aes)”
aes
md5 Setup probe
Global variable
24
Thread-A Thread-B
Find “gcm(aes)”
aes
md5 Setup probe
Dispatch probing
Global variable
25
Thread-A Thread-B
Find “gcm(aes)”
aes
md5 Setup probe
…
1. Template name = “gcm”
2. Cipher name = “aes” “cryptomgr_probe”
Dispatch probing Find template
seqiv
Global variable
gcm
26 Global variable
Thread-A Thread-B
Find “gcm(aes)”
aes
md5 Setup probe
…
1. Template name = “gcm”
2. Cipher name = “aes” “cryptomgr_probe”
gcm(aes)
Dispatch probing Find template
seqiv
Global variable
gcm
Create & initialize …
instance
27 Global variable
Overview
1 packet
Send packets
Encrypt packets
on TCP
TLS socket
28
Overview
2 packets
Send packets
Encrypt packets
on TCP
TLS socket Send packets
Encrypt packets
on TCP
29
Overview
N packets
Send packets
Encrypt packets
on TCP
TLS socket Send packets
Encrypt packets
on TCP
Send packets
Encrypt packets
on TCP
30
Overview
CR
YP
TO
_A
LG
_AS
YN
C
31
Overview
N packets (asynchronous mode)
Send packets
Encrypt packets
on TCP
TLS socket Send packets
Encrypt packets
on TCP
Send packets
Encrypt packets
on TCP
32
Overview
Vendor speci c drivers
33
fi
Overview
• Cryptd
• Enabled when the CONFIG_CRYPTO_CRYPTD compile option is set
• A crypto daemon which converts an arbitrary synchronous crypto algorithm
into an asynchronous algorithm that runs in a kthread
34
Overview
• Cryptd
• Enabled when the CONFIG_CRYPTO_CRYPTD compile option is set
• A crypto daemon which converts an arbitrary synchronous crypto algorithm
into an asynchronous algorithm that runs in a kthread
• Used as a template
35
Thread-A Thread-B
Find “cryptd(XXX)”
aes
md5 Setup probe
…
1. Template name = “cryptd”
2. Cipher name = “XXX” “cryptomgr_probe”
Dispatch probing Find template
seqiv
Global variable
gcm
Create & initialize …
instance
cryptd
36 Global variable
Thread-A Thread-B
Find “cryptd(XXX)”
aes
md5 Setup probe
…
1. Template name = “cryptd”
2. Cipher name = “XXX” “cryptomgr_probe”
Dispatch probing Find template
seqiv
Global variable
gcm
Create & initialize …
instance
cryptd
37 Global variable
Thread-A Thread-B
Find “cryptd(XXX)”
aes
md5 Setup probe
…
1. Template name = “cryptd”
2. Cipher name = “XXX” “cryptomgr_probe”
cryptd(XXX)
Dispatch probing Find template
seqiv
Global variable
gcm
Create & initialize …
instance
cryptd
Same as the original algorithm (XXX in here) but with asynchronous mode enabled
38 Global variable
Overview
• But how?
39
Overview
• AF_ALG
• Interface to kernel crypto API
• Algorithm probing with user-provided algorithm name
40
Thread-B
Thread-A
(cryptd_queue_worker)
Encrypt a packet
Pending queue
41
Thread-B
Thread-A
(cryptd_queue_worker)
Encrypt a packet
Encqueue request
(Cryptd)
Pending queue
42
Thread-B
Thread-A
(cryptd_queue_worker)
Encrypt a packet
Encqueue request
(Cryptd)
Wakeup worker !!
Pending queue
43
Thread-B
Thread-A
(cryptd_queue_worker)
Encrypt a packet
Encqueue request
(Cryptd)
Wakeup worker Dequeue request
Return
Pending queue
44
Thread-B
Thread-A
(cryptd_queue_worker)
Encrypt a packet
Encqueue request
(Cryptd)
Wakeup worker Dequeue request
Return Handle request
Pending queue
45
Vulnerability
46
Vulnerability
CVE-2024-26800
CVE-2024-26582
CVE-2024-26584
CVE-2024-26585
CVE-2024-26583
47
Vulnerability
CVE-2024-26800
CVE-2024-26582
CVE-2024-26584
CVE-2024-26585
CVE-2024-26583
48
Vulnerability
CVE-2024-26583
49
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
50
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
notify
Finish
51
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
Continue Finish
Exit
52
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
wait_for_completion()
Continue complete()
Finish
Exit
53
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
Continue Finish
Timer or something
Exit
54
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
Continue Finish
Timer or something
Exit
55
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
Continue Finish
Timer or something
Exit Exit
Free TX/RX context …
56
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
Continue Finish
Timer or something
Exit Exit
57
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
Continue Finish
Exit Exit
58
Thread-B
Thread-A
(cryptd_queue_worker)
Dispatch packet Dequeue request
Waiting Handle request
Continue Finish
Exit Exit
UAF when accessing TX/RX context object
59
