CVE-2024-26584

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: tls: handle backlogging of crypto requests

Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our

requests to the crypto API, crypto_aead_{encrypt,decrypt} can return

-EBUSY instead of -EINPROGRESS in valid situations. For example, when

the cryptd queue for AESNI is full (easy to trigger with an

artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued

to the backlog but still processed. In that case, the async callback

will also be called twice: first with err == -EINPROGRESS, which it

seems we can just ignore, then with err == 0.

Compared to Sabrina's original patch this version uses the new

tls_*crypt_async_wait() helpers and converts the EBUSY to

EINPROGRESS to avoid having to modify all the error handling

paths. The handling is identical.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References