net/tls: Fix tls_sk_proto_close Executed Repeatedly in Linux Kernel
Summary
GSD-2022-1004264: net/tls: fix tls_sk_proto_close executed repeatedly. Affects Kernel versions >= 95fa145479fbc0a0c1fd3274ceb42ec03c042a4a, < 9b95ee8990d9b4b6086c309632b9d0d576833abe. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources, device drivers, and security. The net/tls module in the Linux Kernel is responsible for implementing Transport Layer Security (TLS) protocol support for network connections. TLS is a cryptographic protocol that ensures secure communication over a network. However, a vulnerability has been discovered in the net/tls module that can lead to the repeated execution of the tls_sk_proto_close function.
Vulnerability Detail
The vulnerability arises from a flaw in the net/tls module, specifically in the tls_sk_proto_close function. Due to this flaw, the tls_sk_proto_close function can be executed repeatedly, potentially leading to resource exhaustion and denial-of-service (DoS) conditions. An attacker could exploit this vulnerability by establishing multiple TLS connections and triggering the repeated execution of the tls_sk_proto_close function. This could result in the consumption of excessive system resources, leading to system instability or unavailability. The vulnerability was introduced in Linux Kernel version v5.3 and has been fixed in version v5.18.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The net/tls module in the Linux Kernel is susceptible to a vulnerability that allows the tls_sk_proto_close function to be executed repeatedly, potentially leading to resource exhaustion and denial-of-service (DoS) conditions. It is crucial to update the Linux Kernel to version v5.18.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to resource exhaustion and denial-of-service (DoS) conditions in systems running the affected Linux Kernel versions.
An attacker can exploit this vulnerability by establishing multiple TLS connections and triggering the repeated execution of the tls_sk_proto_close function.
Yes, this vulnerability has been fixed in Linux Kernel version v5.18.8.
There are no known instances of this vulnerability being exploited in the wild.
No workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
