In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decrypt state and geometry. BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544) Read of size 4 at addr ffff888013085750 by task tls/13529 CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme Call Trace: kasan_report+0xca/0x100 tls_strp_check_rcv+0x898/0x9a0 [tls] tls_rx_rec_wait+0x2c9/0x8d0 [tls] tls_sw_recvmsg+0x40f/0x1aa0 [tls] inet_recvmsg+0x1c3/0x1f0 Always reload the queue, fast path is to have the record in the queue when we wake, anyway (IOW the path going down "if !strp->stm.full_len").
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: TLS: siempre actualiza la cola al leer un archivo SOCK. Tras cambios recientes en Net-Next, TCP compacta los archivos SKB de forma mucho más agresiva. Esto reveló un error en TLS que permite intentar operar en un archivo SKB antiguo al comprobar si todos los archivos SKB de la cola tienen el mismo estado de descifrado y geometría. BUG: KASAN: slab-use-after-free in tls_strp_check_rcv+0x898/0x9a0 [tls] (net/tls/tls_strp.c:436 net/tls/tls_strp.c:530 net/tls/tls_strp.c:544) Read of size 4 at addr ffff888013085750 by task tls/13529 CPU: 2 UID: 0 PID: 13529 Comm: tls Not tainted 6.16.0-rc5-virtme Call Trace: kasan_report+0xca/0x100 tls_strp_check_rcv+0x898/0x9a0 [tls] tls_rx_rec_wait+0x2c9/0x8d0 [tls] tls_sw_recvmsg+0x40f/0x1aa0 [tls] inet_recvmsg+0x1c3/0x1f0 Siempre recargue la cola, la ruta rápida es tener el registro en la cola cuando nos despertamos, de todos modos (es decir, la ruta que baja "if !strp->stm.full_len").
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bde4f2900> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bde4f3ac0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bde4f0e40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bcbbf69c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bde4f2a00> | Operating System |
| linux | linux_kernel | 6.1 | <built-in method update of dict object at 0x702bde4f12c0> | Operating System |
| linux | linux_kernel | 6.1 | <built-in method update of dict object at 0x702bde4f2480> | Operating System |
| linux | linux_kernel | 6.1 | <built-in method update of dict object at 0x702b40329bc0> | Operating System |
| linux | linux_kernel | 6.1 | <built-in method update of dict object at 0x702bde4f3a80> | Operating System |
| linux | linux_kernel | 6.1 | <built-in method update of dict object at 0x702bde4f3140> | Operating System |
| linux | linux_kernel | 6.1 | <built-in method update of dict object at 0x702bdd8a6700> | Operating System |
| linux | linux_kernel | 6.1 | <built-in method update of dict object at 0x702b4032abc0> | Operating System |
| linux | linux_kernel | 6.1 | <built-in method update of dict object at 0x702bde4f0600> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bcbbf7e40> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bcbbf6940> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bcbbf47c0> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bdd8a4980> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702b4032a780> | Operating System |
| linux | linux_kernel | 6.16 | <built-in method update of dict object at 0x702bde4f2ec0> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x702b4032b940> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |