CVE-2024-47658

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The damaging consequence is reached through the IPsec ESP receive path — a remote peer's ESP packets drive `esp_input()`, whose completion callback `esp_input_done` → `xfrm_input_resume()` is invoked by the stm32-cryp threaded IRQ handler with BH enabled. The upstream engine check that this driver violates was itself added after the same failure was hit with network traffic (iperf over IPsec).

AC:LAttack complexity, low

The BH-enabled completion happens on every interrupt-mode request, and the recursion requires only that a NET_RX softirq land on the same CPU while `x->lock` is held — a window the attacker widens at will by sustaining ESP packet volume, controlling both sides of the race. The original reporter reproduced it with ordinary iperf load.

PR:NPrivileges required, none

No credentials on the target are needed: ESP frames sent to a known SPI enter `esp_input()` and reach `esp_input_done` even when authentication fails, and ordinary tunnel traffic from any remote host suffices. The alternate local vector via AF_ALG is likewise available to a fully unprivileged user.

UI:NUser interaction, none

Triggering requires only sending network traffic to a device whose IPsec/crypto operations are backed by the STM32 CRYP accelerator; no action by any local user or administrator is involved.

S:UScope, unchanged

The fault is a locking-context violation contained entirely within the kernel; no VM, IOMMU, or sandbox boundary is crossed and no other security authority is affected.

C:NConfidentiality impact, none

The defect is an incorrect execution context for a completion callback, not a memory-safety error — there is no out-of-bounds read, no freed-object reuse, and no path by which attacker-readable data is exposed.

I:NIntegrity impact, none

No memory is corrupted and no attacker-controlled write primitive arises; the callback simply runs with bottom halves enabled, which affects serialization rather than data content.

A:HAvailability impact, high

Recursive acquisition of `xfrm_state->lock` from the re-entered `xfrm_input()` produces a spinlock-recursion BUG and a hard deadlock on that CPU, hanging IPsec/network processing (and panicking outright under `panic_on_warn`).