{"id":"CVE-2024-58239","state":"PUBLISHED","title":"tls: stop recv() if initial process_rx_list gave us non-DATA","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: stop recv() if initial process_rx_list gave us non-DATA\n\nIf we have a non-DATA record on the rx_list and another record of the\nsame type still on the queue, we will end up merging them:\n - process_rx_list copies the non-DATA record\n - we start the loop and process the first available record since it's\n   of the same type\n - we break out of the loop since the record was not DATA\n\nJust check the record type and jump to the end in case process_rx_list\ndid some work.","publishedAt":"2025-08-22T13:01:17.440Z","updatedAt":"2026-10-15T21:51:51.549Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"f310143961e2d9a0479fca117ce869f8aaecc140","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"31e10d6cb0c9532ff070cf50da1657c3acee9276","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"4338032aa90bd1d5b33a4274e8fa8347cda5ee09","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"6756168add1c6c3ef1c32c335bb843a5d1f99a75","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"a4ed943882a8fc057ea5a67643314245e048bbdd","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"fdfbaec5923d9359698cbb286bc0deadbb717504","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tls/tls_sw.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.1","versionType":"semver"},{"version":"5.4.270","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.211","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.150","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.80","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.19","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.7","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tls/tls_sw.c"]}],"references":["https://git.kernel.org/stable/c/f310143961e2d9a0479fca117ce869f8aaecc140","https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276","https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09","https://git.kernel.org/stable/c/6756168add1c6c3ef1c32c335bb843a5d1f99a75","https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f","https://git.kernel.org/stable/c/a4ed943882a8fc057ea5a67643314245e048bbdd","https://git.kernel.org/stable/c/fdfbaec5923d9359698cbb286bc0deadbb717504"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/58xxx/CVE-2024-58239.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-58239","state":"PUBLISHED","datePublished":"2025-08-22T13:01:17.440Z","dateUpdated":"2026-10-15T21:51:51.549Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:19:43.804Z"},"containers":{"cna":{"title":"tls: stop recv() if initial process_rx_list gave us non-DATA","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: stop recv() if initial process_rx_list gave us non-DATA\n\nIf we have a non-DATA record on the rx_list and another record of the\nsame type still on the queue, we will end up merging them:\n - process_rx_list copies the non-DATA record\n - we start the loop and process the first available record since it's\n   of the same type\n - we break out of the loop since the record was not DATA\n\nJust check the record type and jump to the end in case process_rx_list\ndid some work."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"f310143961e2d9a0479fca117ce869f8aaecc140","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"31e10d6cb0c9532ff070cf50da1657c3acee9276","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"4338032aa90bd1d5b33a4274e8fa8347cda5ee09","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"6756168add1c6c3ef1c32c335bb843a5d1f99a75","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"a4ed943882a8fc057ea5a67643314245e048bbdd","versionType":"git"},{"version":"692d7b5d1f9125a1cf0595e979e3b5fb7210547e","status":"affected","lessThan":"fdfbaec5923d9359698cbb286bc0deadbb717504","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tls/tls_sw.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.1","versionType":"semver"},{"version":"5.4.270","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.211","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.150","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.80","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.19","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.7","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/tls/tls_sw.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f310143961e2d9a0479fca117ce869f8aaecc140"},{"url":"https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276"},{"url":"https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09"},{"url":"https://git.kernel.org/stable/c/6756168add1c6c3ef1c32c335bb843a5d1f99a75"},{"url":"https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f"},{"url":"https://git.kernel.org/stable/c/a4ed943882a8fc057ea5a67643314245e048bbdd"},{"url":"https://git.kernel.org/stable/c/fdfbaec5923d9359698cbb286bc0deadbb717504"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The bug lives in net/tls (kTLS) receive processing and is driven entirely by the sequence and types of TLS records a remote peer transmits over the network. Any kTLS-enabled endpoint (OpenSSL/nginx offload, NVMe-TCP target, NFS/RPC-with-TLS, tlshd-provisioned sockets) is reachable from the network.\nAC:L - The attacker simply sends two same-type non-DATA records back-to-back, and can force the required \"leftover record on rx_list\" precondition by making the first control record larger than the reader's buffer (partially_consumed → put_on_rx_list). There is no race, no memory-layout dependency, and no timing window to win.\nPR:N - The attacker only needs to be the TLS peer on an established session; on a public kTLS server the handshake is server-authenticated only, so any anonymous client can complete it and then emit arbitrary post-handshake alert/handshake records. No privileges or accounts on the target host are required.\nUI:N - The vulnerable path is the target's ordinary recvmsg() server loop; no victim action beyond normal socket reads is needed. The remote peer triggers it purely by its own record transmission pattern.\nS:U - The consequences are confined to the affected socket and the kernel/process security authority that owns it. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - Only the attacker's own decrypted record payload is delivered to the consumer; all copies remain bounded by the caller-supplied len, so no kernel memory, uninitialized data, or other-session content is exposed.\nI:L - A remote peer can make the kernel coalesce two distinct TLS control records into one recvmsg() under a single TLS_GET_RECORD_TYPE cmsg with no intervening record boundary, corrupting the protocol message stream handed to the consumer — e.g. tls_alert_recv() parses only the first two bytes, letting a fatal alert be hidden behind a preceding warning alert. The modification is real but limited to attacker-supplied control-message framing, not arbitrary data or control-flow.\nA:H - With MSG_WAITALL, target is derived from the full requested length before len -= copied, so after process_rx_list returns a complete control record the loop re-enters tls_rx_rec_wait() and blocks indefinitely (default SO_RCVTIMEO of 0) instead of returning the record. The wedged reader holds ctx->reader_present, so every other thread reading that socket also stalls in tls_rx_reader_acquire(), and a remote peer can repeat this across connections to hang service threads."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:47:49.124Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.4.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.10.211"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"5.15.150"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.1.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.7.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.1","versionEndExcluding":"6.8"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-58239","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T21:42:29.347860Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:51:51.549Z"}}]}}}