cbcvebase.
CVE-2024-26800
published 2024-04-04

CVE-2024-26800: In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the…

PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.28%
20.3th percentile
In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptions have completed. If one of them fails, tls_do_decryption will return -EBADMSG and tls_decrypt_sg jumps to the error path, releasing all the pages. But the pages have been passed to the async callback, and have already been released by tls_decrypt_done. The only true async case is when crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited so we can tell tls_sw_recvmsg that the data is available for immediate copy, but we need to notify tls_decrypt_sg (via the new ->async_done flag) that the memory has already been released.

Affected

30 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.85-1 (bookworm)linux 6.1.85-1 (bookworm)
linuxlinux
linuxlinux>= 13eca403876bbea3716e82cdfe6f1e6febb38754 < 81be85353b0f5a7b660635634b655329b429eefe81be85353b0f5a7b660635634b655329b429eefe
linuxlinux>= 5.15.160 < 5.165.16
linuxlinux>= 6.6.18 < 6.6.216.6.21
linuxlinux>= 6.7.6 < 6.7.96.7.9
linuxlinux>= 8590541473188741055d27b955db0777569438e3 < 13114dc5543069f7b97991e3b79937b6da05f5b013114dc5543069f7b97991e3b79937b6da05f5b0
linuxlinux>= ab6397f072e5097f267abf5cb08a8004e6b17694 < 1ac9fb84bc7ecd4bc6428118301d9d864d2a58d11ac9fb84bc7ecd4bc6428118301d9d864d2a58d1
linuxlinux>= cd1bbca03f3c1d845ce274c0d0a66de8e5929f72 < f2b85a4cc763841843de693bbd7308fe9a2c4c89f2b85a4cc763841843de693bbd7308fe9a2c4c89
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.85-16.1.85-1
linuxlinux_kernel>= 0 < 6.7.9-16.7.9-1
linuxlinux_kernel>= 0 < 6.7.9-16.7.9-1
linuxlinux_kernel>= 0 < 5.4.0-200.2205.4.0-200.220
linuxlinux_kernel>= 0 < 5.15.0-125.1355.15.0-125.135
linuxlinux_kernel>= 0 < 4.4.0-267.3014.4.0-267.301
linuxlinux_kernel>= 0 < 4.15.0-233.2454.15.0-233.245
linuxlinux_kernel>= 0 < 4.15.0-232.2444.15.0-232.244
linuxlinux_kernel>= 0 < 5.4.0-205.2255.4.0-205.225
linuxlinux_kernel>= 0 < 5.4.0-204.2245.4.0-204.224
linuxlinux_kernel>= 0 < 5.15.0-131.1415.15.0-131.141
linuxlinux_kernel>= 0 < 5.15.0-130.1405.15.0-130.140
linuxlinux_kernel>= 0 < 6.8.0-52.536.8.0-52.53
linuxlinux_kernel>= 0 < 6.8.0-51.526.8.0-51.52
linuxlinux_kernel>= 5.15.160 < 5.165.16

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.