Linux kernel (net/tls): KTLS assumes it owns the TCP receive queue. When another reader drains bytes first, the old

Impact

KTLS assumes it owns the TCP receive queue. When another reader drains bytes first, the old code hit a WARN and returned early leaving the strparser anchor pointing at a freed skb, and could read past the end of what is actually queued. Beyond the memory-safety hit, the parser can then decrypt something that is not a valid record - a missed alert or a missed attack on that stream.

Who can reach it

Local: a process that read from the TCP socket before the TLS ULP was installed, or that uses a non-standard/zerocopy read API on the same socket. That is a same-container or same-process condition rather than a cross-tenant one, but it is unprivileged and needs no device node; the peer supplies the record data that gets misparsed.

What to do

Boot a kernel carrying the linked stable commits. Interim: install the TLS ULP before any read on the socket and do not mix zerocopy receive with kTLS.

References