277 lines
15 KiB
JSON
277 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-58239",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-04-16T07:19:43.804Z",
|
|
"datePublished": "2025-08-22T13:01:17.440Z",
|
|
"dateUpdated": "2026-10-15T21:51:51.549Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:47:49.124Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: stop recv() if initial process_rx_list gave us non-DATA\n\nIf we have a non-DATA record on the rx_list and another record of the\nsame type still on the queue, we will end up merging them:\n - process_rx_list copies the non-DATA record\n - we start the loop and process the first available record since it's\n of the same type\n - we break out of the loop since the record was not DATA\n\nJust check the record type and jump to the end in case process_rx_list\ndid some work."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
|
|
"baseScore": 8.2,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The bug lives in net/tls (kTLS) receive processing and is driven entirely by the sequence and types of TLS records a remote peer transmits over the network. Any kTLS-enabled endpoint (OpenSSL/nginx offload, NVMe-TCP target, NFS/RPC-with-TLS, tlshd-provisioned sockets) is reachable from the network.\nAC:L - The attacker simply sends two same-type non-DATA records back-to-back, and can force the required \"leftover record on rx_list\" precondition by making the first control record larger than the reader's buffer (partially_consumed → put_on_rx_list). There is no race, no memory-layout dependency, and no timing window to win.\nPR:N - The attacker only needs to be the TLS peer on an established session; on a public kTLS server the handshake is server-authenticated only, so any anonymous client can complete it and then emit arbitrary post-handshake alert/handshake records. No privileges or accounts on the target host are required.\nUI:N - The vulnerable path is the target's ordinary recvmsg() server loop; no victim action beyond normal socket reads is needed. The remote peer triggers it purely by its own record transmission pattern.\nS:U - The consequences are confined to the affected socket and the kernel/process security authority that owns it. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - Only the attacker's own decrypted record payload is delivered to the consumer; all copies remain bounded by the caller-supplied len, so no kernel memory, uninitialized data, or other-session content is exposed.\nI:L - A remote peer can make the kernel coalesce two distinct TLS control records into one recvmsg() under a single TLS_GET_RECORD_TYPE cmsg with no intervening record boundary, corrupting the protocol message stream handed to the consumer — e.g. tls_alert_recv() parses only the first two bytes, letting a fatal alert be hidden behind a preceding warning alert. The modification is real but limited to attacker-supplied control-message framing, not arbitrary data or control-flow.\nA:H - With MSG_WAITALL, target is derived from the full requested length before len -= copied, so after process_rx_list returns a complete control record the loop re-enters tls_rx_rec_wait() and blocks indefinitely (default SO_RCVTIMEO of 0) instead of returning the record. The wedged reader holds ctx->reader_present, so every other thread reading that socket also stalls in tls_rx_reader_acquire(), and a remote peer can repeat this across connections to hang service threads."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/tls/tls_sw.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "692d7b5d1f9125a1cf0595e979e3b5fb7210547e",
|
|
"lessThan": "f310143961e2d9a0479fca117ce869f8aaecc140",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "692d7b5d1f9125a1cf0595e979e3b5fb7210547e",
|
|
"lessThan": "31e10d6cb0c9532ff070cf50da1657c3acee9276",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "692d7b5d1f9125a1cf0595e979e3b5fb7210547e",
|
|
"lessThan": "4338032aa90bd1d5b33a4274e8fa8347cda5ee09",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "692d7b5d1f9125a1cf0595e979e3b5fb7210547e",
|
|
"lessThan": "6756168add1c6c3ef1c32c335bb843a5d1f99a75",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "692d7b5d1f9125a1cf0595e979e3b5fb7210547e",
|
|
"lessThan": "3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "692d7b5d1f9125a1cf0595e979e3b5fb7210547e",
|
|
"lessThan": "a4ed943882a8fc057ea5a67643314245e048bbdd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "692d7b5d1f9125a1cf0595e979e3b5fb7210547e",
|
|
"lessThan": "fdfbaec5923d9359698cbb286bc0deadbb717504",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/tls/tls_sw.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.1",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.1",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.270",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.211",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.150",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.80",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.19",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.7.7",
|
|
"lessThanOrEqual": "6.7.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.8",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.1",
|
|
"versionEndExcluding": "5.4.270"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.1",
|
|
"versionEndExcluding": "5.10.211"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.1",
|
|
"versionEndExcluding": "5.15.150"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.1",
|
|
"versionEndExcluding": "6.1.80"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.1",
|
|
"versionEndExcluding": "6.6.19"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.1",
|
|
"versionEndExcluding": "6.7.7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.1",
|
|
"versionEndExcluding": "6.8"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f310143961e2d9a0479fca117ce869f8aaecc140"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6756168add1c6c3ef1c32c335bb843a5d1f99a75"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a4ed943882a8fc057ea5a67643314245e048bbdd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/fdfbaec5923d9359698cbb286bc0deadbb717504"
|
|
}
|
|
],
|
|
"title": "tls: stop recv() if initial process_rx_list gave us non-DATA",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2024-58239",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "yes"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:42:29.347860Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T21:51:51.549Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |