CVE-2024-0646: High Fixes for in Linux Kernel
A flaw in the Linux Kernel found. When splice() is called with a ktls socket as destination, the ktls code fails to update the internal "curr"/"copybreak" accounting that tracks which parts of the plaintext scatter-gather buffer (struct skmsgsg) are unused writable memory. This can cause subsequent writes to the socket to overwrite the contents of spliced pages, including pages from files to which the caller is not supposed to have write access.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5a595000e267
Other sources
An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.
— Launchpad
Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination
— Microsoft
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds memory write flaw in the Transport Layer Security functionality. A local attacker could exploit this vulnerability to gain elevated privileges or cause the system to crash.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-0646?
CVE-2024-0646 is classified as a significant vulnerability in the Linux Kernel affecting ktls sockets.
What systems are affected by CVE-2024-0646?
CVE-2024-0646 affects various versions of the Linux Kernel, Red Hat Enterprise Linux, and specific IBM products.
How do I fix CVE-2024-0646?
To fix CVE-2024-0646, update your Linux Kernel to versions 6.7 or apply patches to vulnerable systems.
What is the impact of CVE-2024-0646?
CVE-2024-0646 may lead to improper access control on ktls sockets, potentially allowing unauthorized access to memory.
When was CVE-2024-0646 discovered?
CVE-2024-0646 was publicly disclosed in 2024.