CVE-2024-58239: tls: stop recv() if initial process_rx_list gave us non-DATA
In the Linux kernel, the following vulnerability has been resolved:
tls: stop recv() if initial processrxlist gave us non-DATA
If we have a non-DATA record on the rxlist and another record of the same type still on the queue, we will end up merging them: - processrxlist copies the non-DATA record - we start the loop and process the first available record since it's of the same type - we break out of the loop since the record was not DATA
Just check the record type and jump to the end in case processrxlist did some work.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58239?
CVE-2024-58239 is classified as a high-severity vulnerability in the Linux kernel affecting various versions.
How do I fix CVE-2024-58239?
To address CVE-2024-58239, users should update their Linux kernel to a version that includes the security patch.
What versions of the Linux kernel are affected by CVE-2024-58239?
CVE-2024-58239 affects Linux kernel versions from 5.1 to 6.8-rc5, excluding some specific sub-versions.
What are the risks of not addressing CVE-2024-58239?
Not addressing CVE-2024-58239 could lead to potential data leaks or unauthorized access due to improper handling of non-DATA records.
Is there a workaround for CVE-2024-58239?
There are no known workarounds for CVE-2024-58239; the recommended action is to apply the necessary kernel updates.