CVE-2024-35841 net: tls, fix WARNIING in __sk_msg_free
A logic error in Linux kernel TLS splice handling causes a kernel warning and potential denial of service when message fragments exceed buffer capacity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35841?
CVE-2024-35841 is a medium-severity denial of service vulnerability in Linux kernel, published on 17 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: tls, fix WARNIING in __sk_msg_free
A splice with MSG_SPLICE_PAGES will cause tls code to use the tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user provided pages from the msg into the msg_pl. This will loop over the msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user can also set the MORE flag to hint stack to delay sending until receiving more pages and ideally a full buffer.
If the user adds more pages to the msg than can fit in the msg_pl scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send the buffer anyways.
What actually happens though is we abort the msg to msg_pl scatterlist setup and then because we forget to set 'full record' indicating we can no longer consume data without a send we fallthrough to the 'continue' path which will check if msg_data_left(msg) has more bytes to send and then attempts to fit them in the already full msg_pl. Then next iteration of sender doing send will encounter a full msg_pl and throw the warning in the syzbot report.
To fix simply check if we have a full_record in splice code path and if not send the msg regardless of MORE flag.
Which versions are affected by CVE-2024-35841?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-35841?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-35841 being exploited?
There is no known exploitation of CVE-2024-35841 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-35841, DEBIAN-CVE-2024-35841, GHSA-5c5w-jm9h-wvq9, UBUNTU-CVE-2024-35841.