TLS Crypto Request Backlogging Vulnerability in Linux Kernel
Summary
CVE-2024-26584: In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources and facilitates communication between hardware and software components. This vulnerability affects the TLS (Transport Layer Security) implementation within the kernel, specifically related to the handling of asynchronous cryptographic requests, which can lead to unexpected behavior under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of crypto requests within the TLS subsystem. When the CRYPTO_TFM_REQ_MAY_BACKLOG flag is set, functions like crypto_aead_encrypt and crypto_aead_decrypt may return -EBUSY instead of -EINPROGRESS in valid scenarios. This can occur when the cryptd queue for AESNI is full, potentially leading to confusion in error handling as the async callback may be triggered twice. The first callback may indicate an in-progress state, which can be misleading, while the second callback indicates successful processing. This vulnerability can lead to improper handling of cryptographic operations, affecting the security and reliability of applications relying on TLS.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the necessary updates as soon as they are available.
Conclusion
The TLS crypto request backlogging vulnerability in the Linux kernel poses a significant risk to systems relying on secure communications. Users are strongly advised to update their Linux kernel to the latest versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-26584 is a vulnerability in the Linux kernel's TLS subsystem that affects the handling of asynchronous cryptographic requests.
The vulnerability affects Linux kernel versions prior to the fixed versions specified for Debian 11, 12, and 13.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your manifest file, such as package-lock.json.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of severity.
While the vulnerability may lead to improper handling of cryptographic operations, it does not directly indicate a risk of data loss. However, it could affect the security of data transmissions.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
