CVE-2023-3108

What it actually does

Race condition in get_user_pages_fast called from skcipher_recvmsg allows a local process to trigger a kernel crash via concurrent access to symmetric key cipher algorithm state in crypto/algif_skcipher.c.

Why it matters to the business

Local denial-of-service that forces system reboot and interrupts all workloads on the affected Linux host; low likelihood of remote exploitation or data loss but repeated crashes can degrade availability of services running on that kernel.

How an attack unfolds

An attacker with local shell access crafts concurrent calls to AF_ALG sockets that exercise skcipher_recvmsg while the kernel performs get_user_pages_fast, winning the race to produce invalid page references that panic the kernel.

How to fix it

Update the Linux kernel to commit 39a8804455fb23f09157341d3ba7db6d7ae6ee76 or later; rebuild and reboot with the patched kernel. If immediate patching is not possible, restrict untrusted local accounts and disable AF_ALG if unused.

How to confirm the fix worked

Confirm the running kernel contains commit 39a8804455fb23f09157341d3ba7db6d7ae6ee76 via 'git log' or package version checks; attempt to reproduce the original race with a local test program and verify the system no longer panics.

Typical attack path

1. Obtain local unprivileged shell on the target Linux system
2. Open AF_ALG sockets and bind to a symmetric cipher algorithm
3. Issue concurrent sendmsg/recvmsg operations that trigger skcipher_recvmsg
4. Win the race in get_user_pages_fast to produce a kernel fault
5. Kernel panics and the system reboots or hangs

How to detect it

Review kernel crash logs (dmesg, /var/log/kern.log) for oops/panic entries referencing skcipher_recvmsg or get_user_pages_fast; correlate with process accounting showing untrusted users executing crypto-related syscalls immediately before the crash.

What your security team should do

• Prioritize kernel upgrade on all internet-facing or multi-tenant systems within the next maintenance window
• Monitor for local privilege-escalation chains that could leverage this crash as a building block
• Review and limit use of AF_ALG sockets by untrusted workloads until patched