CVE-2025-39682

Vulnerability

Description

In the Linux kernel's TLS implementation, a flaw exists in how zero-length records are handled when they arrive on the rx_list. Each recvmsg() call is designed to process either contiguous DATA records or a single non-DATA record. If the next record's type differs from what has already been processed, the kernel breaks out of the main processing loop. For TLS 1.3, where the record type is unknown until decryption, a decrypted record may be queued to rx_list for the next recvmsg(). However, queuing an skb after zero-copy decryption is impossible because zero-copy decrypts directly into user space, leaving no skb to queue (only a ciphertext skb for metadata). Only DATA records are eligible for zero-copy, and the loop breaks after each non-DATA record, so zero-copy should never occur with a type change. The missed corner case is when the initial record comes from rx_list and is zero-length, leading to an attempt to queue a non-existent skb and resulting in a use-after-free condition.

Exploitation

Scenario

An attacker with the ability to send crafted TLS records to a vulnerable system could trigger this bug. The attack requires the ability to establish a TLS connection and inject a zero-length record that is placed on the rx_list. No special privileges are needed beyond network access to the TLS endpoint. The vulnerability is triggered during the recvmsg() system call when the kernel processes the zero-length record from rx_list.

Impact

Successful exploitation could lead to a use-after-free, potentially allowing an attacker to corrupt kernel memory. This may result in a denial of service (system crash) or, in more severe cases, arbitrary code execution in the kernel context. The CVSS v3 score is 7.1 (High), reflecting the potential for significant impact on confidentiality, integrity, and availability.

Mitigation

The Linux kernel has released patches for this vulnerability, as seen in stable kernel commits [2]. Users should update their kernels to the latest stable versions that include the fix. Additionally, Siemens has identified this CVE as affecting SIMATIC CN 4100 devices (all versions < V5.0) and recommends updating to V5.0 or later [1]. No workarounds are currently available; applying the kernel patch is the recommended course of action.