In the Linux kernel, the following vulnerability has been resolved:
tls: fix use-after-free on failed backlog decryption
When the decrypt request goes to the backlog and cryptoaeaddecrypt returns -EBUSY, tlsdodecryption will wait until all async decryptions have completed. If one of them fails, tlsdodecryption will return -EBADMSG and tlsdecryptsg jumps to the error path, releasing all the pages. But the pages have been passed to the async callback, and have already been released by tlsdecryptdone.
The only true async case is when cryptoaeaddecrypt returns -EINPROGRESS. With -EBUSY, we already waited so we can tell tlsswrecvmsg that the data is available for immediate copy, but we need to notify tlsdecryptsg (via the new ->async_done flag) that the memory has already been released.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26800.json"
}[
{
"digest": {
"length": 1042.0,
"function_hash": "17485071933124177626669850898740689534"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2b85a4cc763841843de693bbd7308fe9a2c4c89",
"deprecated": false,
"id": "CVE-2024-26800-001e4284",
"signature_type": "Function",
"target": {
"function": "tls_do_decryption",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 3735.0,
"function_hash": "170365839820440216939426709832917690246"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81be85353b0f5a7b660635634b655329b429eefe",
"deprecated": false,
"id": "CVE-2024-26800-08a93c51",
"signature_type": "Function",
"target": {
"function": "tls_decrypt_sg",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 3735.0,
"function_hash": "170365839820440216939426709832917690246"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13114dc5543069f7b97991e3b79937b6da05f5b0",
"deprecated": false,
"id": "CVE-2024-26800-1357ee4a",
"signature_type": "Function",
"target": {
"function": "tls_decrypt_sg",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 3735.0,
"function_hash": "170365839820440216939426709832917690246"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1",
"deprecated": false,
"id": "CVE-2024-26800-28dc9898",
"signature_type": "Function",
"target": {
"function": "tls_decrypt_sg",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 3735.0,
"function_hash": "170365839820440216939426709832917690246"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2b85a4cc763841843de693bbd7308fe9a2c4c89",
"deprecated": false,
"id": "CVE-2024-26800-2e6a5dbc",
"signature_type": "Function",
"target": {
"function": "tls_decrypt_sg",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"91458972350561544326412933514326698452",
"17796350288975258404664381473414996438",
"254540669276023803516820438523668881465",
"189443888227556752012713133998599627741",
"65218845490838992166112223242890639496",
"5924970174050516837812453528327432378",
"165517062498826954796705216316502477334",
"23033976011646813047285692023612463525",
"43934023344147082720258455473044408026",
"96394810001120581118670839705882604247",
"185812307976228941186971833314783259671",
"47991965962095347395705490116496227157",
"317023393931246473874033674157613375387",
"1001955752944266897322692684263154454",
"34438511758258458297550949957454110698",
"114327152637964857313182524699485966055",
"57109587464478572547155454462874706706",
"331377201148667245156173468476554637834",
"262827870799346597635527552544319799355",
"142784946105535944502077763439981655977",
"255041821121617187882568199653893053946",
"87691803993584707147358162635964562639",
"22327501990318717974669395080781775432",
"144917186723892641625863298648588528070",
"26403860616154261877471490373361678775"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1",
"deprecated": false,
"id": "CVE-2024-26800-45fd9f0a",
"signature_type": "Line",
"target": {
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"91458972350561544326412933514326698452",
"17796350288975258404664381473414996438",
"254540669276023803516820438523668881465",
"189443888227556752012713133998599627741",
"65218845490838992166112223242890639496",
"5924970174050516837812453528327432378",
"165517062498826954796705216316502477334",
"23033976011646813047285692023612463525",
"43934023344147082720258455473044408026",
"96394810001120581118670839705882604247",
"185812307976228941186971833314783259671",
"47991965962095347395705490116496227157",
"317023393931246473874033674157613375387",
"1001955752944266897322692684263154454",
"34438511758258458297550949957454110698",
"114327152637964857313182524699485966055",
"57109587464478572547155454462874706706",
"331377201148667245156173468476554637834",
"262827870799346597635527552544319799355",
"142784946105535944502077763439981655977",
"255041821121617187882568199653893053946",
"87691803993584707147358162635964562639",
"22327501990318717974669395080781775432",
"144917186723892641625863298648588528070",
"26403860616154261877471490373361678775"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13114dc5543069f7b97991e3b79937b6da05f5b0",
"deprecated": false,
"id": "CVE-2024-26800-58be0235",
"signature_type": "Line",
"target": {
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1100.0,
"function_hash": "279142614296668194425463291291563640517"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81be85353b0f5a7b660635634b655329b429eefe",
"deprecated": false,
"id": "CVE-2024-26800-946a71b8",
"signature_type": "Function",
"target": {
"function": "tls_do_decryption",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"91458972350561544326412933514326698452",
"17796350288975258404664381473414996438",
"254540669276023803516820438523668881465",
"189443888227556752012713133998599627741",
"46420094004320788428428727581983462540",
"4720000279716410595950638479328525465",
"165517062498826954796705216316502477334",
"23033976011646813047285692023612463525",
"43934023344147082720258455473044408026",
"96394810001120581118670839705882604247",
"275922739797584731223462242668639040328",
"166242442598087658537733334254879368236",
"1839701962907999507981820002835538704",
"257959240045682293220132259884247413124",
"52433617991399947363626403162847551188",
"220421507304950240955564335118673350812",
"34438511758258458297550949957454110698",
"114327152637964857313182524699485966055",
"57109587464478572547155454462874706706",
"331377201148667245156173468476554637834",
"262827870799346597635527552544319799355",
"142784946105535944502077763439981655977",
"255041821121617187882568199653893053946",
"87691803993584707147358162635964562639",
"22327501990318717974669395080781775432",
"144917186723892641625863298648588528070",
"26403860616154261877471490373361678775"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2b85a4cc763841843de693bbd7308fe9a2c4c89",
"deprecated": false,
"id": "CVE-2024-26800-a81ecd9c",
"signature_type": "Line",
"target": {
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"91458972350561544326412933514326698452",
"17796350288975258404664381473414996438",
"254540669276023803516820438523668881465",
"189443888227556752012713133998599627741",
"65218845490838992166112223242890639496",
"5924970174050516837812453528327432378",
"165517062498826954796705216316502477334",
"23033976011646813047285692023612463525",
"43934023344147082720258455473044408026",
"96394810001120581118670839705882604247",
"185812307976228941186971833314783259671",
"47991965962095347395705490116496227157",
"317023393931246473874033674157613375387",
"1001955752944266897322692684263154454",
"34438511758258458297550949957454110698",
"114327152637964857313182524699485966055",
"57109587464478572547155454462874706706",
"331377201148667245156173468476554637834",
"262827870799346597635527552544319799355",
"142784946105535944502077763439981655977",
"255041821121617187882568199653893053946",
"87691803993584707147358162635964562639",
"22327501990318717974669395080781775432",
"144917186723892641625863298648588528070",
"26403860616154261877471490373361678775"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81be85353b0f5a7b660635634b655329b429eefe",
"deprecated": false,
"id": "CVE-2024-26800-c5d18ce9",
"signature_type": "Line",
"target": {
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1100.0,
"function_hash": "279142614296668194425463291291563640517"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1",
"deprecated": false,
"id": "CVE-2024-26800-d632c81d",
"signature_type": "Function",
"target": {
"function": "tls_do_decryption",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1100.0,
"function_hash": "279142614296668194425463291291563640517"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13114dc5543069f7b97991e3b79937b6da05f5b0",
"deprecated": false,
"id": "CVE-2024-26800-d883cdb0",
"signature_type": "Function",
"target": {
"function": "tls_do_decryption",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26800.json"