From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman To: Reply-to: , Subject: CVE-2024-26583: tls: fix race between async notify and socket close Description =========== In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires. The Linux kernel CVE team has assigned CVE-2024-26583 to this issue. Affected and fixed versions =========================== Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 5.15.160 with commit f17d21ea7391 Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 6.1.79 with commit 7a3ca06d04d5 Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 6.6.18 with commit 86dc27ee36f5 Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 6.7.6 with commit 6209319b2efd Issue introduced in 5.7 with commit 0cada33241d9 and fixed in 6.8 with commit aec7961916f3 Issue introduced in 5.4.44 with commit cf4cc95a15f5 Issue introduced in 5.4.71 with commit 8dc5025c6a44 Issue introduced in 5.6.16 with commit 9b81d43da15e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26583 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/net/tls.h net/tls/tls_sw.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7 https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01 https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33 https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d