CVE-2024-58240 — Use After Free in Linux
Severity
7.8HIGHNVD
EPSS
0.0%
top 95.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 28
Description
In the Linux kernel, the following vulnerability has been resolved:
tls: separate no-async decryption request handling from async
If we're not doing async, the handling is much simpler. There's no
reference counting, we just need to wait for the completion to wake us
up and return its result.
We should preferably also use a separate crypto_wait. I'm not seeing a
UAF as I did in the past, I think aec7961916f3 ("tls: fix race between
async notify and socket close") took care of it.
This will m…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages3 packages
▶CVEListV5linux/linux3c4d7559159bfe1e3b94df3a657b2cda3a34e218 — 48905146d11dbf1ddbb2967319016a83976953f5+4
Also affects: Debian Linux 11.0
Patches
🔴Vulnerability Details
3OSV▶
CVE-2024-58240: In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing a↗2025-08-28
GHSA▶
GHSA-fpx7-665w-c5c9: In the Linux kernel, the following vulnerability has been resolved:
tls: separate no-async decryption request handling from async
If we're not doing↗2025-08-28