Linux kernel (net/tls): Splice with MSG_SPLICE_PAGES and MSG_MORE could push more pages into the plaintext scatterlist

Impact

Splice with MSG_SPLICE_PAGES and MSG_MORE could push more pages into the plaintext scatterlist than MAX_MSG_FRAGS allows. The code failed to mark the record full, fell through to the continue path and kept trying to add data to an already-full scatterlist - the bounds check catches it with a warning, but this is the zerocopy splice path overrunning its own frag budget on attacker-chosen input sizes.

Who can reach it

Local and unprivileged: any process with a kTLS socket calling splice()/sendfile() with MSG_MORE and more pages than fit in one record. Every tenant container can do this with plain socket and file syscalls - no device node, no capability. On a kernel booted with panic_on_warn this becomes a node-wide outage.

What to do

Boot a kernel carrying the linked stable commits. Interim: if the fleet runs panic_on_warn, that setting turns this into a tenant-triggerable node kill - weigh disabling it until patched.

References

Related entries

• Linux kernel (net/tls): Tls_init published the new sk_prot before the TLS context was fully initialized, so aCVE-2024-36489 · Linux kernel (net/tls)Medium
• Linux kernel (net/tls): Tls_sw_recvmsg takes a psock reference before acquiring the reader lock and returns withoutCVE-2024-35908 · Linux kernel (net/tls)Medium
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): KTLS allocates a 12-byte IV buffer for AES-128-CCM but the decrypt path copies 16 bytes out ofCVE-2022-49094 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): The async decrypt completion released pages that the decrypt path never took a reference on, soCVE-2024-26582 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): The thread in recvmsg/sendmsg can exit as soon as the async crypto callback signals completionCVE-2024-26583 · Linux kernel (net/tls)Critical