CVE-2023-52767

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tls: fix NULL deref on tls_sw_splice_eof() with empty record

syzkaller discovered that if tls_sw_splice_eof() is executed as part of

sendfile() when the plaintext/ciphertext sk_msg are empty, the send path

gets confused because the empty ciphertext buffer does not have enough

space for the encryption overhead. This causes tls_push_record() to go on

the `split = true` path (which is only supposed to be used when interacting

with an attached BPF program), and then get further confused and hit the

tls_merge_open_record() path, which then assumes that there must be at

least one populated buffer element, leading to a NULL deref.

It is possible to have empty plaintext/ciphertext buffers if we previously

bailed from tls_sw_sendmsg_locked() via the tls_trim_both_msgs() path.

tls_sw_push_pending_record() already handles this case correctly; let's do

the same check in tls_sw_splice_eof().

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References