In the Linux kernel, the following vulnerability has been resolved:
tls: fix NULL deref on tls_sw_splice_eof() with empty record
syzkaller discovered that if tls_sw_splice_eof() is executed as part of sendfile() when the plaintext/ciphertext sk_msg are empty, the send path gets confused because the empty ciphertext buffer does not have enough space for the encryption overhead. This causes tls_push_record() to go on the `split = true` path (which is only supposed to be used when interacting with an attached BPF program), and then get further confused and hit the tls_merge_open_record() path, which then assumes that there must be at least one populated buffer element, leading to a NULL deref.
It is possible to have empty plaintext/ciphertext buffers if we previously bailed from tls_sw_sendmsg_locked() via the tls_trim_both_msgs() path. tls_sw_push_pending_record() already handles this case correctly; let's do the same check in tls_sw_splice_eof().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade dlm-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade kernel-develUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-syms-azureUpgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-appleUpgrade kernel-rtUpgrade kernel-debug-develUpgrade kernel-source-vanillaUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade kernel-64kb-optionalUpgrade kernel-rt-optionalUpgrade dtb-sprdUpgrade dtb-qcomUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade kernel-64kbUpgrade kernel-docs-htmlUpgrade kernel-default-optionalUpgrade dtb-amazonUpgrade kernel-rt-vdsoUpgrade dtb-lgUpgrade kernel-sourceUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade dtb-caviumUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-develUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade kernel-obs-buildUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade dtb-amdUpgrade dtb-broadcomUpgrade dtb-freescaleUpgrade kernel-devel-azureUpgrade dtb-apmUpgrade dtb-armUpgrade dlm-kmp-azureUpgrade dtb-socionextUpgrade dtb-renesasUpgrade kernel-symsUpgrade kernel-debug-livepatch-develUpgrade dtb-rockchipUpgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-zfcpdumpUpgrade kernel-64kb-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade kernel-rt_debug-vdsoUpgrade dtb-nvidiaUpgrade dlm-kmp-rtUpgrade dtb-hisiliconUpgrade kselftests-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-rt-develUpgrade kernel-macrosUpgrade kernel-default-livepatch-develUpgrade dtb-mediatekUpgrade dlm-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-debugUpgrade kernel-azure-develUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-azure-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-64kb-develUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade kernel-azure-livepatch-develUpgrade dtb-xilinx | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-6.5 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub