CVE-2024-26584
net: tls: handle backlogging of crypto requests
In the Linux kernel, the following vulnerability has been resolved:net: tls: handle backlogging of crypto requestsSince we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on ourrequests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRESS in valid situations. For example, whenthe cryptd queue for AESNI is full (easy to trigger with anartificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueuedto the backlog but still processed. In that case, the async callbackwill also be called twice: first with err == -EINPROGRESS, which itseems we can just ignore, then with err == 0.Compared to Sabrina's original patch this version uses the newtls_*crypt_async_wait() helpers and converts the EBUSY toEINPROGRESS to avoid having to modify all the error handlingpaths. The handling is identical.
- Affected
- Linux
- CVSS v3.1 NVD
- 5.5 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1 CNA
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.74% chance of exploitation in the next 30 days, 54th percentile
- Published
- 2024-02-21
- Updated
- 2026-08-05
Exploit collections (1)
- linux/kernelctf/CVE-2024-26584_lts_cosgoogle/security-research
Security advisories
- https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754
- https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3
- https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694
- https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72