CVE-2024-26800: tls: fix use-after-free on failed backlog decryption
In the Linux kernel, the following vulnerability has been resolved:
tls: fix use-after-free on failed backlog decryption
When the decrypt request goes to the backlog and cryptoaeaddecrypt returns -EBUSY, tlsdodecryption will wait until all async decryptions have completed. If one of them fails, tlsdodecryption will return -EBADMSG and tlsdecryptsg jumps to the error path, releasing all the pages. But the pages have been passed to the async callback, and have already been released by tlsdecryptdone.
The only true async case is when cryptoaeaddecrypt returns -EINPROGRESS. With -EBUSY, we already waited so we can tell tlsswrecvmsg that the data is available for immediate copy, but we need to notify tlsdecryptsg (via the new ->asyncdone flag) that the memory has already been released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26800?
CVE-2024-26800 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26800?
To fix CVE-2024-26800, users should update to the patched versions of the Linux kernel as specified in the security advisories.
Which versions of the Linux kernel are affected by CVE-2024-26800?
CVE-2024-26800 affects Linux kernel versions 6.6.18 to 6.6.21, 6.7.6 to 6.7.9, and specific 6.8 release candidates.
What type of vulnerability is CVE-2024-26800?
CVE-2024-26800 is a use-after-free vulnerability occurring during failed backlog decryption in the TLS protocol within the Linux kernel.
Has CVE-2024-26800 been officially resolved?
Yes, CVE-2024-26800 has been resolved in the Linux kernel with appropriate patches released.