Linux kernel (net/tls): KTLS allocates a 12-byte IV buffer for AES-128-CCM but the decrypt path copies 16 bytes out of

Impact

KTLS allocates a 12-byte IV buffer for AES-128-CCM but the decrypt path copies 16 bytes out of it, so every inbound record over-reads four bytes of adjacent slab memory into the AEAD input. Neighbouring heap contents feed the crypto operation and a remote peer holds a repeatable slab-overread primitive against the node terminating its connection.

Who can reach it

Reachable by any unprivileged process on the node that owns a TCP socket - no device node required. setsockopt(SOL_TLS, TLS_RX, TLS_CIPHER_AES_CCM_128) with TLS 1.3, then receive records from the peer. Applies to tenant workloads using kTLS and to any storage or control-plane daemon on the node configured for CCM; the peer supplying the records drives the overread.

What to do

Boot a kernel carrying the linked stable commits. Interim: restrict kTLS ciphersuites to AES-GCM in the daemons you control and disable AES-CCM-128 offload, or disable the tls ULP (blacklist the tls module) where it is not required.

References