cve-2024-35841
Vulnerability from cvelistv5
Published
2024-05-17 14:27
Modified
2024-12-19 08:56
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: tls, fix WARNIING in __sk_msg_free A splice with MSG_SPLICE_PAGES will cause tls code to use the tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user provided pages from the msg into the msg_pl. This will loop over the msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user can also set the MORE flag to hint stack to delay sending until receiving more pages and ideally a full buffer. If the user adds more pages to the msg than can fit in the msg_pl scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send the buffer anyways. What actually happens though is we abort the msg to msg_pl scatterlist setup and then because we forget to set 'full record' indicating we can no longer consume data without a send we fallthrough to the 'continue' path which will check if msg_data_left(msg) has more bytes to send and then attempts to fit them in the already full msg_pl. Then next iteration of sender doing send will encounter a full msg_pl and throw the warning in the syzbot report. To fix simply check if we have a full_record in splice code path and if not send the msg regardless of MORE flag.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9
Impacted products
Vendor Product Version
Linux Linux Version: fe1e81d4f73b6cbaed4fcc476960d26770642842
Version: fe1e81d4f73b6cbaed4fcc476960d26770642842
Version: fe1e81d4f73b6cbaed4fcc476960d26770642842
 Create a notification for this product.
   Linux Linux Version: 6.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T03:21:48.073Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-35841",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-10T15:41:46.618855Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-11T17:33:18.283Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "net/tls/tls_sw.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "02e368eb1444a4af649b73cbe2edd51780511d86",
                     status: "affected",
                     version: "fe1e81d4f73b6cbaed4fcc476960d26770642842",
                     versionType: "git",
                  },
                  {
                     lessThan: "294e7ea85f34748f04e5f3f9dba6f6b911d31aa8",
                     status: "affected",
                     version: "fe1e81d4f73b6cbaed4fcc476960d26770642842",
                     versionType: "git",
                  },
                  {
                     lessThan: "dc9dfc8dc629e42f2234e3327b75324ffc752bc9",
                     status: "affected",
                     version: "fe1e81d4f73b6cbaed4fcc476960d26770642842",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "net/tls/tls_sw.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "6.5",
                  },
                  {
                     lessThan: "6.5",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.14",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.7.*",
                     status: "unaffected",
                     version: "6.7.2",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.8",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls, fix WARNIING in __sk_msg_free\n\nA splice with MSG_SPLICE_PAGES will cause tls code to use the\ntls_sw_sendmsg_splice path in the TLS sendmsg code to move the user\nprovided pages from the msg into the msg_pl. This will loop over the\nmsg until msg_pl is full, checked by sk_msg_full(msg_pl). The user\ncan also set the MORE flag to hint stack to delay sending until receiving\nmore pages and ideally a full buffer.\n\nIf the user adds more pages to the msg than can fit in the msg_pl\nscatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send\nthe buffer anyways.\n\nWhat actually happens though is we abort the msg to msg_pl scatterlist\nsetup and then because we forget to set 'full record' indicating we\ncan no longer consume data without a send we fallthrough to the 'continue'\npath which will check if msg_data_left(msg) has more bytes to send and\nthen attempts to fit them in the already full msg_pl. Then next\niteration of sender doing send will encounter a full msg_pl and throw\nthe warning in the syzbot report.\n\nTo fix simply check if we have a full_record in splice code path and\nif not send the msg regardless of MORE flag.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T08:56:21.471Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86",
            },
            {
               url: "https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8",
            },
            {
               url: "https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9",
            },
         ],
         title: "net: tls, fix WARNIING in __sk_msg_free",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-35841",
      datePublished: "2024-05-17T14:27:31.822Z",
      dateReserved: "2024-05-17T13:50:33.104Z",
      dateUpdated: "2024-12-19T08:56:21.471Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-35841\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T15:15:21.160\",\"lastModified\":\"2024-11-21T09:21:01.320\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tls, fix WARNIING in __sk_msg_free\\n\\nA splice with MSG_SPLICE_PAGES will cause tls code to use the\\ntls_sw_sendmsg_splice path in the TLS sendmsg code to move the user\\nprovided pages from the msg into the msg_pl. This will loop over the\\nmsg until msg_pl is full, checked by sk_msg_full(msg_pl). The user\\ncan also set the MORE flag to hint stack to delay sending until receiving\\nmore pages and ideally a full buffer.\\n\\nIf the user adds more pages to the msg than can fit in the msg_pl\\nscatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send\\nthe buffer anyways.\\n\\nWhat actually happens though is we abort the msg to msg_pl scatterlist\\nsetup and then because we forget to set 'full record' indicating we\\ncan no longer consume data without a send we fallthrough to the 'continue'\\npath which will check if msg_data_left(msg) has more bytes to send and\\nthen attempts to fit them in the already full msg_pl. Then next\\niteration of sender doing send will encounter a full msg_pl and throw\\nthe warning in the syzbot report.\\n\\nTo fix simply check if we have a full_record in splice code path and\\nif not send the msg regardless of MORE flag.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net: tls, corrija la ADVERTENCIA en __sk_msg_free Un empalme con MSG_SPLICE_PAGES hará que el código tls use la ruta tls_sw_sendmsg_splice en el código TLS sendmsg para mover las páginas proporcionadas por el usuario del msg al msg_pl . Esto recorrerá el mensaje hasta que msg_pl esté lleno, verificado por sk_msg_full(msg_pl). El usuario también puede configurar el indicador MORE para que la pila de sugerencias retrase el envío hasta recibir más páginas e idealmente un búfer completo. Si el usuario agrega más páginas al mensaje de las que caben en la lista de dispersión msg_pl (MAX_MSG_FRAGS), debemos ignorar el indicador MÁS y enviar el búfer de todos modos. Sin embargo, lo que realmente sucede es que abortamos la configuración de la lista de dispersión de msg a msg_pl y luego, como nos olvidamos de configurar el 'registro completo', lo que indica que ya no podemos consumir datos sin un envío, pasamos a la ruta 'continuar' que verificará si msg_data_left(msg) tiene más bytes para enviar y luego intenta incluirlos en el msg_pl que ya está completo. Luego, la próxima iteración del remitente que realiza el envío encontrará un msg_pl completo y arrojará la advertencia en el informe syzbot. Para solucionarlo, simplemente verifique si tenemos un registro completo en la ruta del código de empalme y, si no, envíe el mensaje independientemente del indicador MORE.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.073Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35841\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:41:46.618855Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:16.039Z\"}}], \"cna\": {\"title\": \"net: tls, fix WARNIING in __sk_msg_free\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fe1e81d4f73b\", \"lessThan\": \"02e368eb1444\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe1e81d4f73b\", \"lessThan\": \"294e7ea85f34\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fe1e81d4f73b\", \"lessThan\": \"dc9dfc8dc629\", \"versionType\": \"git\"}], \"programFiles\": [\"net/tls/tls_sw.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"6.6.14\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/tls/tls_sw.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86\"}, {\"url\": \"https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8\"}, {\"url\": \"https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9\"}], \"x_generator\": {\"engine\": \"bippy-a5840b7849dd\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: tls, fix WARNIING in __sk_msg_free\\n\\nA splice with MSG_SPLICE_PAGES will cause tls code to use the\\ntls_sw_sendmsg_splice path in the TLS sendmsg code to move the user\\nprovided pages from the msg into the msg_pl. This will loop over the\\nmsg until msg_pl is full, checked by sk_msg_full(msg_pl). The user\\ncan also set the MORE flag to hint stack to delay sending until receiving\\nmore pages and ideally a full buffer.\\n\\nIf the user adds more pages to the msg than can fit in the msg_pl\\nscatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send\\nthe buffer anyways.\\n\\nWhat actually happens though is we abort the msg to msg_pl scatterlist\\nsetup and then because we forget to set 'full record' indicating we\\ncan no longer consume data without a send we fallthrough to the 'continue'\\npath which will check if msg_data_left(msg) has more bytes to send and\\nthen attempts to fit them in the already full msg_pl. Then next\\niteration of sender doing send will encounter a full msg_pl and throw\\nthe warning in the syzbot report.\\n\\nTo fix simply check if we have a full_record in splice code path and\\nif not send the msg regardless of MORE flag.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-05-29T05:29:55.784Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-35841\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-11T17:33:18.283Z\", \"dateReserved\": \"2024-05-17T13:50:33.104Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T14:27:31.822Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.