cve-2024-26583
Vulnerability from cvelistv5
Published
2024-02-21 14:59
Modified
2024-12-19 08:42
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8dPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4aPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8dPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7
Impacted products
Vendor Product Version
Linux Linux Version: 5.7
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T16:41:40.480459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:01.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/tls.h",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "lessThan": "7a3ca06d04d589deec81f56229a9a9d62352ce01",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "lessThan": "86dc27ee36f558fe223dbdfbfcb6856247356f4a",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "lessThan": "6209319b2efdd8524691187ee99c40637558fa33",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "lessThan": "aec7961916f3f9e88766e2688992da6980f11b8d",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/tls.h",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between async notify and socket close\n\nThe submitting thread (one which called recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete()\nso any code past that point risks touching already freed data.\n\nTry to avoid the locking and extra flags altogether.\nHave the main thread hold an extra reference, this way\nwe can depend solely on the atomic ref counter for\nsynchronization.\n\nDon\u0027t futz with reiniting the completion, either, we are now\ntightly controlling when completion fires."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:42:56.872Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01"
        },
        {
          "url": "https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33"
        },
        {
          "url": "https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d"
        }
      ],
      "title": "tls: fix race between async notify and socket close",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26583",
    "datePublished": "2024-02-21T14:59:11.845Z",
    "dateReserved": "2024-02-19T14:20:24.125Z",
    "dateUpdated": "2024-12-19T08:42:56.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26583\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-02-21T15:15:09.373\",\"lastModified\":\"2024-11-21T09:02:35.347\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntls: fix race between async notify and socket close\\n\\nThe submitting thread (one which called recvmsg/sendmsg)\\nmay exit as soon as the async crypto handler calls complete()\\nso any code past that point risks touching already freed data.\\n\\nTry to avoid the locking and extra flags altogether.\\nHave the main thread hold an extra reference, this way\\nwe can depend solely on the atomic ref counter for\\nsynchronization.\\n\\nDon\u0027t futz with reiniting the completion, either, we are now\\ntightly controlling when completion fires.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: tls: corrige la ejecuci\u00f3n entre la notificaci\u00f3n as\u00edncrona y el cierre del socket. El hilo de env\u00edo (uno que llam\u00f3 recvmsg/sendmsg) puede salir tan pronto como el controlador criptogr\u00e1fico as\u00edncrono llame a complete(), por lo que cualquier c\u00f3digo pasado ese punto corre el riesgo de tocar datos ya liberados. Intente evitar por completo el bloqueo y las banderas adicionales. Haga que el hilo principal contenga una referencia adicional, de esta manera podemos depender \u00fanicamente del contador de referencia at\u00f3mica para la sincronizaci\u00f3n. Tampoco te preocupes por reiniciar la finalizaci\u00f3n, ahora estamos controlando estrictamente cu\u00e1ndo se activa la finalizaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7.0\",\"versionEndExcluding\":\"6.1.79\",\"matchCriteriaId\":\"37AE2B04-CF69-412C-89AE-605725C54364\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.0\",\"versionEndExcluding\":\"6.6.18\",\"matchCriteriaId\":\"A5CC150E-F35C-4CF7-ADF5-422D32C511C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.0\",\"versionEndExcluding\":\"6.7.6\",\"matchCriteriaId\":\"0C8D1FAD-4D5D-4A25-B058-2AD15082710E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.