CVE-2023-52767 tls: fix NULL deref on tls_sw_splice_eof() with empty record
A NULL pointer dereference in the Linux kernel TLS module allows local attackers to cause a system crash via sendfile operations with empty records.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52767?
CVE-2023-52767 is a medium-severity vulnerability in Linux kernel, published on 21 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tls: fix NULL deref on tls_sw_splice_eof() with empty record
syzkaller discovered that if tls_sw_splice_eof() is executed as part of sendfile() when the plaintext/ciphertext sk_msg are empty, the send path gets confused because the empty ciphertext buffer does not have enough space for the encryption overhead. This causes tls_push_record() to go on the `split = true` path (which is only supposed to be used when interacting with an attached BPF program), and then get further confused and hit the tls_merge_open_record() path, which then assumes that there must be at least one populated buffer element, leading to a NULL deref.
It is possible to have empty plaintext/ciphertext buffers if we previously bailed from tls_sw_sendmsg_locked() via the tls_trim_both_msgs() path. tls_sw_push_pending_record() already handles this case correctly; let's do the same check in tls_sw_splice_eof().
Weakness: CWE-476
Which versions are affected by CVE-2023-52767?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52767?
Apply the vendor's patch.
Is CVE-2023-52767 being exploited?
There is no known exploitation of CVE-2023-52767 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52767, DEBIAN-CVE-2023-52767, GHSA-vr35-f6m3-rh89, UBUNTU-CVE-2023-52767.