{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-58239","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:19:43.804Z","datePublished":"2025-08-22T13:01:17.440Z","dateUpdated":"2026-08-05T11:47:49.124Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:47:49.124Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: stop recv() if initial process_rx_list gave us non-DATA\n\nIf we have a non-DATA record on the rx_list and another record of the\nsame type still on the queue, we will end up merging them:\n - process_rx_list copies the non-DATA record\n - we start the loop and process the first available record since it's\n   of the same type\n - we break out of the loop since the record was not DATA\n\nJust check the record type and jump to the end in case process_rx_list\ndid some work."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The bug lives in net/tls (kTLS) receive processing and is driven entirely by the sequence and types of TLS records a remote peer transmits over the network. Any kTLS-enabled endpoint (OpenSSL/nginx offload, NVMe-TCP target, NFS/RPC-with-TLS, tlshd-provisioned sockets) is reachable from the network.\nAC:L - The attacker simply sends two same-type non-DATA records back-to-back, and can force the required \"leftover record on rx_list\" precondition by making the first control record larger than the reader's buffer (partially_consumed → put_on_rx_list). There is no race, no memory-layout dependency, and no timing window to win.\nPR:N - The attacker only needs to be the TLS peer on an established session; on a public kTLS server the handshake is server-authenticated only, so any anonymous client can complete it and then emit arbitrary post-handshake alert/handshake records. No privileges or accounts on the target host are required.\nUI:N - The vulnerable path is the target's ordinary recvmsg() server loop; no victim action beyond normal socket reads is needed. The remote peer triggers it purely by its own record transmission pattern.\nS:U - The consequences are confined to the affected socket and the kernel/process security authority that owns it. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - Only the attacker's own decrypted record payload is delivered to the consumer; all copies remain bounded by the caller-supplied len, so no kernel memory, uninitialized data, or other-session content is exposed.\nI:L - A remote peer can make the kernel coalesce two distinct TLS control records into one recvmsg() under a single TLS_GET_RECORD_TYPE cmsg with no intervening record boundary, corrupting the protocol message stream handed to the consumer — e.g. tls_alert_recv() parses only the first two bytes, letting a fatal alert be hidden behind a preceding warning alert. The modification is real but limited to attacker-supplied control-message framing, not arbitrary data or control-flow.\nA:H - With MSG_WAITALL, target is derived from the full requested length before len -= copied, so after process_rx_list returns a complete control record the loop re-enters tls_rx_rec_wait() and blocks indefinitely (default SO_RCVTIMEO of 0) instead of returning the record. The wedged reader holds ctx->reader_present, so every other thread reading that socket also stalls in tls_rx_reader_acquire(), and a remote peer can repeat this across connections to hang service threads."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tls/tls_sw.c"],"versions":[{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","lessThan":"f310143961e2d9a0479fca117ce869f8aaecc140","status":"affected","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","lessThan":"31e10d6cb0c9532ff070cf50da1657c3acee9276","status":"affected","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","lessThan":"4338032aa90bd1d5b33a4274e8fa8347cda5ee09","status":"affected","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","lessThan":"6756168add1c6c3ef1c32c335bb843a5d1f99a75","status":"affected","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","lessThan":"3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f","status":"affected","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","lessThan":"a4ed943882a8fc057ea5a67643314245e048bbdd","status":"affected","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","lessThan":"fdfbaec5923d9359698cbb286bc0deadbb717504","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tls/tls_sw.c"],"versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","status":"unaffected","versionType":"semver"},{"version":"5.4.270","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.211","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.150","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.80","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.19","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.7","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.4.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.10.211"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.15.150"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.1.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.7.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f310143961e2d9a0479fca117ce869f8aaecc140"},{"url":"https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276"},{"url":"https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09"},{"url":"https://git.kernel.org/stable/c/6756168add1c6c3ef1c32c335bb843a5d1f99a75"},{"url":"https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f"},{"url":"https://git.kernel.org/stable/c/a4ed943882a8fc057ea5a67643314245e048bbdd"},{"url":"https://git.kernel.org/stable/c/fdfbaec5923d9359698cbb286bc0deadbb717504"}],"title":"tls: stop recv() if initial process_rx_list gave us non-DATA","x_generator":{"engine":"bippy-1.2.0"}}}}