CVE-2024-58240

Vulnerability

Overview

The vulnerability resides in the Linux kernel's TLS (Transport Layer Security) implementation. The issue stems from the mishandling of decryption request paths: asynchronous (async) and non-async requests were not properly separated. Specifically, the code did not use a dedicated crypto_wait structure for non-async requests, potentially leading to race conditions where completion handlers could be corrupted or misused [1].

Exploitation

Conditions

Exploitation requires the ability to trigger TLS decryption operations in the kernel, which typically involves network access to a system using TLS-enabled sockets. An attacker would need to send crafted network traffic that forces the kernel to handle decryption requests in a way that exposes the race condition. No special privileges beyond network connectivity are necessary, but the attack surface is limited to systems where TLS offloading or kernel TLS (kTLS) is in use.

Impact

A successful exploit could result in a use-after-free (UAF) condition, allowing an attacker to corrupt kernel memory. The description references a prior fix (aec7961916f3) that addressed a similar UAF scenario, indicating that this vulnerability could potentially be leveraged for privilege escalation or denial of service. The exact impact depends on kernel memory layout and exploitability.

Mitigation

Patches have been committed to the Linux kernel stable tree [2][3][4]. Users should apply the latest kernel updates from their distribution. The vulnerability affects any system using kernel TLS, including servers and devices like Siemens SIMATIC CN 4100 (all versions < V5.0) [1]. Administrators are advised to update to a fixed kernel version promptly.