by Kastro
Paper/Archive/CVE-2024-26582

CVE-2024-26582

Linux Linux — net: tls: fix use-after-free with partial reads and async decrypt

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.8.538 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and we trigger a use-after-free in process_rx_list when we try to read from the partially-read skb.

Affected

ProductAffectedFixed inSource
Linuxfd31f3996af2627106e22a9f8072764fede51161 – < 20b4ed034872b4d024b26e2bc1092c3f80e5db9620b4ed034872b4d024b26e2bc1092c3f80e5db96CNA
Linuxfd31f3996af2627106e22a9f8072764fede51161 – < d684763534b969cca1022e2a28645c7cc91f7fa5d684763534b969cca1022e2a28645c7cc91f7fa5CNA
Linuxfd31f3996af2627106e22a9f8072764fede51161 – < 754c9bab77a1b895b97bd99d754403c505bc79df754c9bab77a1b895b97bd99d754403c505bc79dfCNA
Linuxfd31f3996af2627106e22a9f8072764fede51161 – < 32b55c5ff9103b8508c1e04bfa5a08c64e7a925f32b55c5ff9103b8508c1e04bfa5a08c64e7a925fCNA
Linux6.06.1.79CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgit.kernel.org/stable/c/20b4ed034872b4d024b26e2bc1092c3f80e5db96refgit.kernel.org/stable/c/d684763534b969cca1022e2a28645c7cc91f7fa5refgit.kernel.org/stable/c/754c9bab77a1b895b97bd99d754403c505bc79dfrefgit.kernel.org/stable/c/32b55c5ff9103b8508c1e04bfa5a08c64e7a925freflists.fedoraproject.org/archives/list/[email protected]/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM