Linux Kernel up to 4.19/6.8-rc4 TLS net/tls/tls_sw.c 16 tls_encrypt_done use after free

Summaryinfo

A vulnerability was found in Linux Kernel up to 4.19/6.8-rc4. It has been classified as problematic. This affects the function tls_encrypt_done of the file net/tls/tls_sw.c 16 of the component TLS Handler. The manipulation leads to use after free. This vulnerability is traded as CVE-2024-26585. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 4.19/6.8-rc4 (Operating System) and classified as problematic. This issue affects the function tls_encrypt_done of the file net/tls/tls_sw.c 16 of the component TLS Handler. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do.

The weakness was shared 02/21/2024. It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2024-26585 since 02/19/2024. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 209075 (SUSE SLES15 Security Update : kernel RT (Live Patch 10 for SLE 15 SP5) (SUSE-SU-2024:3631-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.20 or 6.8-rc5 eliminates this vulnerability. Applying the patch e01e3934a1b2 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (209075). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 4.17
• 4.18
• 4.19
• 6.8-rc1
• 6.8-rc2
• 6.8-rc3
• 6.8-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion