CVE-2024-58240
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability in the Linux kernel related to the handling of decryption requests in synchronous mode has been resolved. The handling of no-async decryption requests has been separated from async, simplifying the process and eliminating reference counting issues.
Risk Assessment
Improper handling of decryption requests may lead to performance issues and potential memory management errors. Organizations should be aware that unpatched versions may be vulnerable to risks associated with improper TLS protocol operation.
Recommendation
It is recommended to update the Linux kernel to the latest version to benefit from fixes related to decryption request handling. Regular monitoring and updating of systems is crucial for maintaining security.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 ("tls: fix race between async notify and socket close") took care of it. This will make the next fix easier.