2253908 – (CVE-2024-0646) CVE-2024-0646 kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

Bug 2253908 (CVE-2024-0646) - CVE-2024-0646 kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

Summary: CVE-2024-0646 kernel: ktls overwrites readonly memory pages when using functi...

Keywords:
Status:	NEW
Alias:	CVE-2024-0646
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	high
Severity:	high
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2259000
Blocks:	2253300
TreeView+	depends on / blocked

Reported:	2023-12-10 20:54 UTC by Alex
Modified:	2024-04-25 14:55 UTC (History)
CC List:	48 users (show)
Fixed In Version:	kernel 6.7-rc5
Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2024:0858	None	None	None	2024-02-19 01:12:26 UTC
Red Hat Product Errata	RHBA-2024:1336	None	None	None	2024-03-14 15:40:51 UTC
Red Hat Product Errata	RHBA-2024:1379	None	None	None	2024-03-19 15:00:42 UTC
Red Hat Product Errata	RHBA-2024:1796	None	None	None	2024-04-11 21:12:09 UTC
Red Hat Product Errata	RHBA-2024:2065	None	None	None	2024-04-25 14:55:16 UTC
Red Hat Product Errata	RHSA-2024:0723	None	None	None	2024-02-07 16:26:00 UTC
Red Hat Product Errata	RHSA-2024:0724	None	None	None	2024-02-07 16:31:00 UTC
Red Hat Product Errata	RHSA-2024:0725	None	None	None	2024-02-07 16:22:04 UTC
Red Hat Product Errata	RHSA-2024:0850	None	None	None	2024-02-15 17:41:53 UTC
Red Hat Product Errata	RHSA-2024:0851	None	None	None	2024-02-15 17:45:45 UTC
Red Hat Product Errata	RHSA-2024:0876	None	None	None	2024-02-20 04:53:54 UTC
Red Hat Product Errata	RHSA-2024:0881	None	None	None	2024-02-20 12:28:56 UTC
Red Hat Product Errata	RHSA-2024:0897	None	None	None	2024-02-20 12:33:38 UTC
Red Hat Product Errata	RHSA-2024:1248	None	None	None	2024-03-12 00:45:34 UTC
Red Hat Product Errata	RHSA-2024:1250	None	None	None	2024-03-12 00:44:37 UTC
Red Hat Product Errata	RHSA-2024:1251	None	None	None	2024-03-12 00:42:07 UTC
Red Hat Product Errata	RHSA-2024:1253	None	None	None	2024-03-12 01:01:09 UTC
Red Hat Product Errata	RHSA-2024:1268	None	None	None	2024-03-12 11:44:08 UTC
Red Hat Product Errata	RHSA-2024:1269	None	None	None	2024-03-12 11:45:16 UTC
Red Hat Product Errata	RHSA-2024:1278	None	None	None	2024-03-12 15:00:39 UTC
Red Hat Product Errata	RHSA-2024:1306	None	None	None	2024-03-13 09:08:20 UTC
Red Hat Product Errata	RHSA-2024:1367	None	None	None	2024-03-19 00:23:09 UTC
Red Hat Product Errata	RHSA-2024:1368	None	None	None	2024-03-19 00:23:41 UTC
Red Hat Product Errata	RHSA-2024:1377	None	None	None	2024-03-19 14:37:57 UTC
Red Hat Product Errata	RHSA-2024:1382	None	None	None	2024-03-19 15:07:55 UTC
Red Hat Product Errata	RHSA-2024:1404	None	None	None	2024-03-19 17:27:44 UTC

Description Alex 2023-12-10 20:54:43 UTC

A flaw in the Linux Kernel found. When splice() is called with a ktls socket as destination, the ktls code fails to update the internal "curr"/"copybreak" accounting that tracks which parts of the plaintext scatter-gather buffer (`struct sk_msg_sg`) are unused writable memory. This can cause subsequent writes to the socket to overwrite the contents of spliced pages, including pages from files to which the caller is not supposed to have write access.

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5a595000e267

Comment 5 Alex 2024-01-17 14:59:48 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2258817]

Comment 8 Alex 2024-01-18 14:54:34 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2259000]

Comment 11 Justin M. Forbes 2024-01-23 21:41:07 UTC

This was fixed for Fedora with the 6.6.7 stable kernel updates.

Comment 13 errata-xmlrpc 2024-02-07 16:22:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0725 https://access.redhat.com/errata/RHSA-2024:0725

Comment 14 errata-xmlrpc 2024-02-07 16:25:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0723 https://access.redhat.com/errata/RHSA-2024:0723

Comment 15 errata-xmlrpc 2024-02-07 16:30:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0724 https://access.redhat.com/errata/RHSA-2024:0724

Comment 17 errata-xmlrpc 2024-02-15 17:41:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0850 https://access.redhat.com/errata/RHSA-2024:0850

Comment 18 errata-xmlrpc 2024-02-15 17:45:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0851 https://access.redhat.com/errata/RHSA-2024:0851

Comment 19 errata-xmlrpc 2024-02-20 04:53:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0876 https://access.redhat.com/errata/RHSA-2024:0876

Comment 20 errata-xmlrpc 2024-02-20 12:28:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0881 https://access.redhat.com/errata/RHSA-2024:0881

Comment 21 errata-xmlrpc 2024-02-20 12:33:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0897 https://access.redhat.com/errata/RHSA-2024:0897

Comment 23 errata-xmlrpc 2024-03-12 00:42:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:1251 https://access.redhat.com/errata/RHSA-2024:1251

Comment 24 errata-xmlrpc 2024-03-12 00:44:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:1250 https://access.redhat.com/errata/RHSA-2024:1250

Comment 25 errata-xmlrpc 2024-03-12 00:45:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:1248 https://access.redhat.com/errata/RHSA-2024:1248

Comment 26 errata-xmlrpc 2024-03-12 01:01:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:1253 https://access.redhat.com/errata/RHSA-2024:1253

Comment 27 errata-xmlrpc 2024-03-12 11:44:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

Via RHSA-2024:1268 https://access.redhat.com/errata/RHSA-2024:1268

Comment 28 errata-xmlrpc 2024-03-12 11:45:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2024:1269 https://access.redhat.com/errata/RHSA-2024:1269

Comment 29 errata-xmlrpc 2024-03-12 15:00:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

Via RHSA-2024:1278 https://access.redhat.com/errata/RHSA-2024:1278

Comment 30 errata-xmlrpc 2024-03-13 09:08:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:1306 https://access.redhat.com/errata/RHSA-2024:1306

Comment 31 errata-xmlrpc 2024-03-19 00:23:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2024:1367 https://access.redhat.com/errata/RHSA-2024:1367

Comment 32 errata-xmlrpc 2024-03-19 00:23:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1368 https://access.redhat.com/errata/RHSA-2024:1368

Comment 33 Charmaine9x 2024-03-19 03:31:30 UTC Comment hidden (spam)

This comment was flagged a spam, view the edit history to see the original text if required.

Comment 34 errata-xmlrpc 2024-03-19 14:37:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:1377 https://access.redhat.com/errata/RHSA-2024:1377

Comment 35 errata-xmlrpc 2024-03-19 15:07:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:1382 https://access.redhat.com/errata/RHSA-2024:1382

Comment 36 errata-xmlrpc 2024-03-19 17:27:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:1404

Note You need to log in before you can comment on or make changes to this bug.

acaringi
allarkin
bhu
chwhite
cye
cyin
dbohanno
debarbos
dfreiber
drow
dvlasenk
ezulian
hkrzesin
jarod
jburrell
jdenham
jfaracco
jforbes
jlelli
joe.lawrence
jpoimboe
jshortt
jstancek
jwyatt
kcarcia
ldoskova
lgoncalv
lzampier
mmilgram
mstowell
nmurray
ptalbert
rogbas
rparrazo
rrobaina
rvrbovsk
rysulliv
scweaver
security-response-team
tglozar
tyberry
vkumar
wcosta
williams
wmealing
ycote
ykopkova
zhijwang