vulnerability
Ubuntu: (Multiple Advisories) (CVE-2024-26584): Linux kernel vulnerabilities
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
5 | (AV:L/AC:L/Au:S/C:N/I:N/A:C) | 02/21/2024 | 05/17/2024 | 01/30/2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
net: tls: handle backlogging of crypto requests
Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our
requests to the crypto API, crypto_aead_{encrypt,decrypt} can return
-EBUSY instead of -EINPROGRESS in valid situations. For example, when
the cryptd queue for AESNI is full (easy to trigger with an
artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued
to the backlog but still processed. In that case, the async callback
will also be called twice: first with err == -EINPROGRESS, which it
seems we can just ignore, then with err == 0.
Compared to Sabrina's original patch this version uses the new
tls_*crypt_async_wait() helpers and converts the EBUSY to
EINPROGRESS to avoid having to modify all the error handling
paths. The handling is identical.
Solution(s)
References
- CVE-2024-26584
- https://attackerkb.com/topics/CVE-2024-26584
- UBUNTU-USN-6765-1
- UBUNTU-USN-6818-1
- UBUNTU-USN-6818-2
- UBUNTU-USN-6818-3
- UBUNTU-USN-6818-4
- UBUNTU-USN-6819-1
- UBUNTU-USN-6819-2
- UBUNTU-USN-6819-3
- UBUNTU-USN-6819-4
- UBUNTU-USN-6820-1
- UBUNTU-USN-6820-2
- UBUNTU-USN-6821-1
- UBUNTU-USN-6821-2
- UBUNTU-USN-6821-3
- UBUNTU-USN-6821-4
- UBUNTU-USN-6828-1
- UBUNTU-USN-6871-1
- UBUNTU-USN-6892-1
- UBUNTU-USN-6919-1
- UBUNTU-USN-6924-1
- UBUNTU-USN-6924-2
- UBUNTU-USN-6953-1
- UBUNTU-USN-6979-1

Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.