CVE-2024-26584

2024-02-2100:00:00

ubuntu.com

linux kernel

net

tls

vulnerability

crypto requests

backlog handling

crypto_tfm_req_may_backlog

-ebusy

-einprogress

cryptd queue

async callback

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

In the Linux kernel, the following vulnerability has been resolved: net:
tls: handle backlogging of crypto requests Since we’re setting the
CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API,
crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRESS in
valid situations. For example, when the cryptd queue for AESNI is full
(easy to trigger with an artificially low cryptd.cryptd_max_cpu_qlen),
requests will be enqueued to the backlog but still processed. In that case,
the async callback will also be called twice: first with err ==
-EINPROGRESS, which it seems we can just ignore, then with err == 0.
Compared to Sabrina’s original patch this version uses the new
tls_*crypt_async_wait() helpers and converts the EBUSY to EINPROGRESS to
avoid having to modify all the error handling paths. The handling is
identical.

Notes

Author	Note
	Priority reason: Reported by Google kCTF
rodrigo-zaiden	USN-6765-1 for linux-oem-6.5 wrongly stated that this CVE was fixed in version 6.5.0-1022.23. The mentioned notice was revoked and the state of the fix for linux-oem-6.5 was recovered to the previous state.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< 5.4.0-190.210UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-112.122UNKNOWN
ubuntu23.10noarchlinux< 6.5.0-41.41UNKNOWN
ubuntu20.04noarchlinux-aws< anyUNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1063.69UNKNOWN
ubuntu23.10noarchlinux-aws< 6.5.0-1021.21UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1063.69~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< anyUNKNOWN
ubuntu22.04noarchlinux-aws-6.5< anyUNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1134.141UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	linux	< 5.4.0-190.210	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-112.122	UNKNOWN
ubuntu	23.10	noarch	linux	< 6.5.0-41.41	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< any	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1063.69	UNKNOWN
ubuntu	23.10	noarch	linux-aws	< 6.5.0-1021.21	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1063.69~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< any	UNKNOWN
ubuntu	22.04	noarch	linux-aws-6.5	< any	UNKNOWN
ubuntu	20.04	noarch	linux-azure	< 5.4.0-1134.141	UNKNOWN