In the Linux kernel, the following vulnerability has been resolved:
net: tls: handle backlogging of crypto requests
Since we're setting the CRYPTOTFMREQMAYBACKLOG flag on our requests to the crypto API, cryptoaead{encrypt,decrypt} can return -EBUSY instead of -EINPROGRESS in valid situations. For example, when the cryptd queue for AESNI is full (easy to trigger with an artificially low cryptd.cryptdmaxcpu_qlen), requests will be enqueued to the backlog but still processed. In that case, the async callback will also be called twice: first with err == -EINPROGRESS, which it seems we can just ignore, then with err == 0.
Compared to Sabrina's original patch this version uses the new tls*cryptasync_wait() helpers and converts the EBUSY to EINPROGRESS to avoid having to modify all the error handling paths. The handling is identical.
[
{
"id": "CVE-2024-26584-00e35a15",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"9071229196567657621620916888260194485",
"77283440197303052568707440124982208241",
"296801496799029643565620881330601986535",
"46420094004320788428428727581983462540",
"218957114751384594662489007371632897428",
"210283237385932953886911143879652216858",
"11819005133160208288052254059198744489",
"340075575724652112005887417295392333165",
"160098765895319016636329514468530345466",
"196674104461820032239282675588066863413",
"211423284480772902439095331296259139053",
"316795066658903967875437487023829284308",
"124276760181613310473638243291842897110",
"178086172663547380176058140996617915210"
],
"threshold": 0.9
},
"target": {
"file": "net/tls/tls_sw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab6397f072e5097f267abf5cb08a8004e6b17694"
},
{
"id": "CVE-2024-26584-267d426c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "274106348774894962788064722719930270407",
"length": 1080.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_decrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ade391adc584f17b5570fd205de3ad029090368"
},
{
"id": "CVE-2024-26584-274db793",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "168454998719877983671187963988083076737",
"length": 890.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_decryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8590541473188741055d27b955db0777569438e3"
},
{
"id": "CVE-2024-26584-2af02b7d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "168454998719877983671187963988083076737",
"length": 890.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_decryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13eca403876bbea3716e82cdfe6f1e6febb38754"
},
{
"id": "CVE-2024-26584-313be7a1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "38779759140338349356872782947081961271",
"length": 949.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_encrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab6397f072e5097f267abf5cb08a8004e6b17694"
},
{
"id": "CVE-2024-26584-35ebf431",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "98858466091816137468484260888994146674",
"length": 1048.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_encrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ade391adc584f17b5570fd205de3ad029090368"
},
{
"id": "CVE-2024-26584-4b820335",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "124524685325133019250336746834350005696",
"length": 886.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_decrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8590541473188741055d27b955db0777569438e3"
},
{
"id": "CVE-2024-26584-6eefeda6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "155252916892359419067541971648147943785",
"length": 961.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_decryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd1bbca03f3c1d845ce274c0d0a66de8e5929f72"
},
{
"id": "CVE-2024-26584-719ec17f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "38779759140338349356872782947081961271",
"length": 949.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_encrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13eca403876bbea3716e82cdfe6f1e6febb38754"
},
{
"id": "CVE-2024-26584-748ab29c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"9071229196567657621620916888260194485",
"77283440197303052568707440124982208241",
"296801496799029643565620881330601986535",
"46420094004320788428428727581983462540",
"218957114751384594662489007371632897428",
"210283237385932953886911143879652216858",
"11819005133160208288052254059198744489",
"77345948797019602379237417623208119807",
"43710117117572278460947168266669675208",
"297800171246348836754764788579803838343",
"211423284480772902439095331296259139053",
"316795066658903967875437487023829284308",
"124276760181613310473638243291842897110",
"178086172663547380176058140996617915210"
],
"threshold": 0.9
},
"target": {
"file": "net/tls/tls_sw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd1bbca03f3c1d845ce274c0d0a66de8e5929f72"
},
{
"id": "CVE-2024-26584-83e7dc22",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"9071229196567657621620916888260194485",
"77283440197303052568707440124982208241",
"296801496799029643565620881330601986535",
"46420094004320788428428727581983462540",
"218957114751384594662489007371632897428",
"210283237385932953886911143879652216858",
"11819005133160208288052254059198744489",
"340075575724652112005887417295392333165",
"160098765895319016636329514468530345466",
"196674104461820032239282675588066863413",
"211423284480772902439095331296259139053",
"316795066658903967875437487023829284308",
"124276760181613310473638243291842897110",
"178086172663547380176058140996617915210"
],
"threshold": 0.9
},
"target": {
"file": "net/tls/tls_sw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8590541473188741055d27b955db0777569438e3"
},
{
"id": "CVE-2024-26584-84e88cb1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"9071229196567657621620916888260194485",
"77283440197303052568707440124982208241",
"296801496799029643565620881330601986535",
"46420094004320788428428727581983462540",
"218957114751384594662489007371632897428",
"210283237385932953886911143879652216858",
"11819005133160208288052254059198744489",
"340075575724652112005887417295392333165",
"160098765895319016636329514468530345466",
"196674104461820032239282675588066863413",
"211423284480772902439095331296259139053",
"316795066658903967875437487023829284308",
"124276760181613310473638243291842897110",
"178086172663547380176058140996617915210"
],
"threshold": 0.9
},
"target": {
"file": "net/tls/tls_sw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13eca403876bbea3716e82cdfe6f1e6febb38754"
},
{
"id": "CVE-2024-26584-8e761ee7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "212725113044799055464269578326034240134",
"length": 1593.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_encryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd1bbca03f3c1d845ce274c0d0a66de8e5929f72"
},
{
"id": "CVE-2024-26584-9857a2c5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "38779759140338349356872782947081961271",
"length": 949.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_encrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8590541473188741055d27b955db0777569438e3"
},
{
"id": "CVE-2024-26584-9dbea1a0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "124524685325133019250336746834350005696",
"length": 886.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_decrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab6397f072e5097f267abf5cb08a8004e6b17694"
},
{
"id": "CVE-2024-26584-b9a2fbb9",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "311520552578059025555100829573401743657",
"length": 1485.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_encryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ade391adc584f17b5570fd205de3ad029090368"
},
{
"id": "CVE-2024-26584-ccf0af10",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "51390274476123414695383636600184976193",
"length": 1591.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_encryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8590541473188741055d27b955db0777569438e3"
},
{
"id": "CVE-2024-26584-ded1ea6b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "166899601320503537344356403847107592171",
"length": 1002.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_decryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ade391adc584f17b5570fd205de3ad029090368"
},
{
"id": "CVE-2024-26584-df34a0c0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"155953123717794950373772179868946149919",
"125220815468837254263305106755220133085",
"236879496243149459890482639482360092770",
"46420094004320788428428727581983462540",
"218957114751384594662489007371632897428",
"210283237385932953886911143879652216858",
"11819005133160208288052254059198744489",
"88104609977381012438139908496723814526",
"306739738588159367838673201505894581806",
"299834903695269170435670909421338358655",
"161234806312064448831190698672708536625",
"261452198269052679846907108866620914886",
"124276760181613310473638243291842897110",
"178086172663547380176058140996617915210"
],
"threshold": 0.9
},
"target": {
"file": "net/tls/tls_sw.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ade391adc584f17b5570fd205de3ad029090368"
},
{
"id": "CVE-2024-26584-e2127a7d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "335682747476571025290002133638369369543",
"length": 879.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_decrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd1bbca03f3c1d845ce274c0d0a66de8e5929f72"
},
{
"id": "CVE-2024-26584-e47eb5f6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "282112216306823349650073617322880421771",
"length": 1019.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_encrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd1bbca03f3c1d845ce274c0d0a66de8e5929f72"
},
{
"id": "CVE-2024-26584-e74c8575",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "51390274476123414695383636600184976193",
"length": 1591.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_encryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab6397f072e5097f267abf5cb08a8004e6b17694"
},
{
"id": "CVE-2024-26584-ec148462",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "51390274476123414695383636600184976193",
"length": 1591.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_encryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13eca403876bbea3716e82cdfe6f1e6febb38754"
},
{
"id": "CVE-2024-26584-ef058745",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "124524685325133019250336746834350005696",
"length": 886.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_decrypt_done"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13eca403876bbea3716e82cdfe6f1e6febb38754"
},
{
"id": "CVE-2024-26584-fdb221ce",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "168454998719877983671187963988083076737",
"length": 890.0
},
"target": {
"file": "net/tls/tls_sw.c",
"function": "tls_do_decryption"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab6397f072e5097f267abf5cb08a8004e6b17694"
}
]