In the Linux kernel, the following vulnerability has been resolved:
tls: stop recv() if initial processrxlist gave us non-DATA
If we have a non-DATA record on the rxlist and another record of the same type still on the queue, we will end up merging them: - processrx_list copies the non-DATA record - we start the loop and process the first available record since it's of the same type - we break out of the loop since the record was not DATA
Just check the record type and jump to the end in case processrxlist did some work.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58239.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58239.json"
[
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f310143961e2d9a0479fca117ce869f8aaecc140",
"id": "CVE-2024-58239-0b0d6c85",
"deprecated": false,
"target": {
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"97981697443783092693029616447907768073",
"188638097780740105904048880968216719637",
"45042644238786447457290652031515499997",
"336187641241384564420953852024151631881"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f310143961e2d9a0479fca117ce869f8aaecc140",
"id": "CVE-2024-58239-343b2299",
"deprecated": false,
"target": {
"function": "tls_sw_recvmsg",
"file": "net/tls/tls_sw.c"
},
"signature_version": "v1",
"digest": {
"length": 4105.0,
"function_hash": "197601288349626146386428449161897749048"
}
}
]