TLS Message Handling Vulnerability in Linux Kernel - CVE-2024-35841
Summary
DEBIAN-CVE-2024-35841: In the Linux kernel, the following vulnerability has been resolved: net: tls, fix WARNIING in __sk_msg_free A splice with MSG_SPLICE_PAGES will cause tls code to use the tls_sw_sendmsg_splice path in the TLS sendmsg code... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. This vulnerability affects the TLS (Transport Layer Security) implementation within the kernel, specifically in how it handles message splicing, which is crucial for secure data transmission.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the TLS code related to message splicing. When using the MSG_SPLICE_PAGES flag, the TLS sendmsg function can mishandle user-provided pages, leading to a situation where the message buffer may become full. If the user sets the MORE flag to indicate that more data is expected, the system should ideally wait for additional pages before sending. However, if the user adds more pages than the buffer can accommodate, the system fails to handle this correctly, resulting in a warning and potential data transmission issues. This flaw can lead to unexpected behavior in applications relying on secure communications, potentially exposing them to data integrity risks.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The CVE-2024-35841 vulnerability in the Linux kernel's TLS message handling poses risks to secure data transmission. Users are advised to update their systems to the patched version to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-35841 is a vulnerability in the Linux kernel's TLS message handling that can lead to improper data transmission and warnings during secure communications.
This vulnerability can lead to issues with secure data transmission, potentially compromising the integrity of the data being sent over TLS connections.
You should update your Linux kernel to version 6.7.7-1 or later to ensure that the vulnerability is patched.
As of now, there are no known exploits publicly available for CVE-2024-35841, but it is advisable to apply the patch promptly to avoid potential risks.
Yes, Vulert can monitor your application for open-source vulnerabilities like CVE-2024-35841 using just a manifest file. You can check if your application is affected without any signup using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
