net/tls: Slab-out-of-bounds Bug in decrypt_internal
Summary
GSD-2022-1001021: net/tls: fix slab-out-of-bounds bug in decrypt_internal. Affects Kernel versions >= f295b3ae9f5927e084bd5decdff82390e3471801, < 2304660ab6c425df64d95301b601424c6a50f28b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/tls package is a component of the Linux Kernel, which is responsible for handling TLS (Transport Layer Security) connections. TLS is a cryptographic protocol that provides secure communication over a network. The net/tls package implements the necessary functionality for TLS decryption and encryption. However, a slab-out-of-bounds bug has been discovered in the decrypt_internal function of the net/tls package.
Vulnerability Detail
The slab-out-of-bounds bug in the decrypt_internal function of the net/tls package allows an attacker to trigger a memory corruption issue. This vulnerability can potentially lead to a variety of security issues, including remote code execution, privilege escalation, and denial-of-service attacks. The bug was introduced in version v5.2 of the Linux Kernel and was fixed in version v5.17.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version to mitigate the risk of exploitation.
Conclusion
The slab-out-of-bounds bug in the decrypt_internal function of the net/tls package can have severe security implications. It is crucial to update the Linux Kernel to version v5.17.3 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/tls package is a component of the Linux Kernel that handles TLS connections and provides secure communication over a network.
A slab-out-of-bounds bug is a type of memory corruption issue where an attacker can access memory outside the bounds of a memory slab, potentially leading to security vulnerabilities.
This vulnerability can allow an attacker to execute arbitrary code, escalate privileges, or launch denial-of-service attacks.
To fix this vulnerability, update the Linux Kernel to version v5.17.3 or later.
No, there is no known workaround for this vulnerability. Updating the Linux Kernel is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
