Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2025-38571

sunrpc: fix client side handling of tls alerts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec. Instead, this patch proposes the rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed control buffer and read in the control message such as a TLS alert. Scott found that a msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • dea034b963c8901bdcc3d3880c04f0d75c95112f to < a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95affected
  • dea034b963c8901bdcc3d3880c04f0d75c95112f to < c36b2fbd60e8f9c6f975522130998608880c93beaffected
  • dea034b963c8901bdcc3d3880c04f0d75c95112f to < 3ee397eaaca4fa04db21bb98c8f1d0c6cc525368affected
  • dea034b963c8901bdcc3d3880c04f0d75c95112f to < 3feada5baf4dc96e151ff2ca54630e1d274e5458affected
  • dea034b963c8901bdcc3d3880c04f0d75c95112f to < cc5d59081fa26506d02de2127ab822f40d88bc5aaffected

Linux Linux

Default version status: affected

  • 6.5affected
  • 0 to < 6.5unaffected
  • 6.6.102 to ≤ 6.6.*unaffected
  • 6.12.42 to ≤ 6.12.*unaffected
  • 6.15.10 to ≤ 6.15.*unaffected
  • 6.16.1 to ≤ 6.16.*unaffected
  • 6.17 to ≤ *unaffected

References