CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak
In the Linux kernel, the following vulnerability has been resolved:
tls: get psock ref after taking rxlock to avoid leak
At the start of tlsswrecvmsg, we take a reference on the psock, and then call tlsrxreaderlock. If that fails, we return directly without releasing the reference.
Instead of adding a new label, just take the reference after locking has succeeded, since we don't need it before.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
tls: get psock ref after taking rxlock to avoid leak
The Linux kernel CVE team has assigned CVE-2024-35908 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051955-CVE-2024-35908-e78a@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35908?
CVE-2024-35908 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35908?
To address CVE-2024-35908, you should upgrade to the latest kernel version provided by your distribution, such as 6.1.85 or later for Red Hat and various versions for Debian.
What version of the kernel is affected by CVE-2024-35908?
CVE-2024-35908 affects specific versions of the Linux kernel, particularly those prior to 6.1.85, 6.6.26, 6.8.5, and 6.9 for Red Hat, and older versions for Debian.
What component of the Linux kernel does CVE-2024-35908 impact?
CVE-2024-35908 impacts the TLS implementation in the Linux kernel.
Is CVE-2024-35908 exploitable remotely?
There is no specific mention of remote exploitability in CVE-2024-35908, but vulnerabilities in kernel components often require local access.