CVE-2024-58240: tls: separate no-async decryption request handling from async
In the Linux kernel, the following vulnerability has been resolved:
tls: separate no-async decryption request handling from async
If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result.
We should preferably also use a separate cryptowait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 ("tls: fix race between async notify and socket close") took care of it.
This will make the next fix easier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel TLSto a version that resolves this vulnerability.Patch aec7961916f3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58240?
CVE-2024-58240 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-58240?
To fix CVE-2024-58240, ensure that you update your Linux kernel to the latest patched version that addresses this vulnerability.
What aspects of the Linux kernel are affected by CVE-2024-58240?
CVE-2024-58240 affects the TLS handling in the Linux kernel, specifically related to synchronous and asynchronous decryption request processing.
Can CVE-2024-58240 be exploited remotely?
Exploitation of CVE-2024-58240 is dependent on the specific implementation and use case of the affected kernel features, but it primarily affects local privileges.
Is there a workaround for CVE-2024-58240 until I can update?
Currently, there are no recommended workarounds for CVE-2024-58240; updating the kernel remains the best approach.