CVE-2024-0646

2024-01-1700:00:00

ubuntu.com

cve-2024-0646

linux kernel

tls

out-of-bounds write

privilege escalation

local user

system crash

bugzilla

red hat

suse

launchpad

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

10.1%

JSON

An out-of-bounds memory write flaw was found in the Linux kernel’s
Transport Layer Security functionality in how a user calls a function
splice with a ktls socket as the destination. This flaw allows a local user
to crash or potentially escalate their privileges on the system.

Bugs

Notes

Author	Note
	Priority reason: Out-of-bounds memory write could lead to a potential local privilege escalation.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< 5.4.0-172.190UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-97.107UNKNOWN
ubuntu23.10noarchlinux< 6.5.0-21.21UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1119.129UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1055.60UNKNOWN
ubuntu23.10noarchlinux-aws< 6.5.0-1014.14UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1055.60~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1119.129~18.04.1UNKNOWN
ubuntu22.04noarchlinux-aws-6.5< anyUNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1124.131UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	linux	< 5.4.0-172.190	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-97.107	UNKNOWN
ubuntu	23.10	noarch	linux	< 6.5.0-21.21	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1119.129	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1055.60	UNKNOWN
ubuntu	23.10	noarch	linux-aws	< 6.5.0-1014.14	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1055.60~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< 5.4.0-1119.129~18.04.1	UNKNOWN
ubuntu	22.04	noarch	linux-aws-6.5	< any	UNKNOWN
ubuntu	20.04	noarch	linux-azure	< 5.4.0-1124.131	UNKNOWN