CVE-2024-26583

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26583
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33 Patch
https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01 Patch
https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a Patch
https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d Patch
https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

25 May 2024, 15:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7 -

15 Mar 2024, 13:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CWE CWE-362
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33 - () https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33 - Patch
References () https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01 - () https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01 - Patch
References () https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a - () https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a - Patch
References () https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d - () https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d - Patch

11 Mar 2024, 18:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OX4EWCYDZRTOEMC2C6OF7ZACAP23SUB5/', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

28 Feb 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OX4EWCYDZRTOEMC2C6OF7ZACAP23SUB5/ -

23 Feb 2024, 09:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a -
  • () https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01 -
  • () https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33 -

21 Feb 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-21 15:15

Updated : 2024-05-25 15:15

NVD link : CVE-2024-26583

Mitre link : CVE-2024-26583

CVE.ORG link : CVE-2024-26583

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')