CVE-2024-26800

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26800
In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptions have completed. If one of them fails, tls_do_decryption will return -EBADMSG and tls_decrypt_sg jumps to the error path, releasing all the pages. But the pages have been passed to the async callback, and have already been released by tls_decrypt_done. The only true async case is when crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited so we can tell tls_sw_recvmsg that the data is available for immediate copy, but we need to notify tls_decrypt_sg (via the new ->async_done flag) that the memory has already been released.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0 Patch
https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1 Patch
https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe Patch
https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89 Patch
https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0 Patch
https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1 Patch
https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe Patch
https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
History

20 Dec 2024, 15:55

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0 - () https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0 - Patch
References () https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1 - () https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1 - Patch
References () https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe - () https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe - Patch
References () https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89 - () https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*

21 Nov 2024, 09:03

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tls: corrige el use-after-free en el descifrado fallido del trabajo pendiente Cuando la solicitud de descifrado va al trabajo pendiente y crypto_aead_decrypt devuelve -EBUSY, tls_do_decryption esperará hasta que se hayan completado todos los descifrados asíncronos. Si uno de ellos falla, tls_do_decryption devolverá -EBADMSG y tls_decrypt_sg salta a la ruta del error, liberando todas las páginas. Pero las páginas se pasaron a la devolución de llamada asíncrona y tls_decrypt_done ya las publicó. El único caso asíncrono verdadero es cuando crypto_aead_decrypt devuelve -EINPROGRESS. Con -EBUSY, ya esperamos para poder decirle a tls_sw_recvmsg que los datos están disponibles para copia inmediata, pero debemos notificar a tls_decrypt_sg (a través del nuevo indicador ->async_done) que la memoria ya ha sido liberada.
References () https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0 - () https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0 -
References () https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1 - () https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1 -
References () https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe - () https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe -
References () https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89 - () https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89 -

04 Apr 2024, 14:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0 -
  • () https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89 -

04 Apr 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-04 09:15

Updated : 2024-12-20 15:55

NVD link : CVE-2024-26800

Mitre link : CVE-2024-26800

CVE.ORG link : CVE-2024-26800

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free