In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/tls: Fail tls_sw_splice_read() after a failed async decrypt<\/p>\n
When an async decrypt fails, tls_decrypt_done() records the error in
\nctx->async_wait.err and calls tls_err_abort(), which stores it in
\nsk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read
\nasync_wait.err once they hold the reader lock and fail the call: a
\nrecord that did not authenticate breaks the connection.<\/p>\n
tls_sw_splice_read() has no such check, and sk_err does not stand in
\nfor one. tls_rx_rec_wait() tests sk_err only inside the loop it
\nskips whenever a record is already parsed, and the first reader to
\nreach sock_error() clears it, while async_wait.err persists. A
\nsplice therefore keeps delivering records on a connection that
\nrecvmsg() and read_sock() refuse to read.<\/p>\n
Read async_wait.err in tls_sw_splice_read() as the other two readers
\ndo.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/tls: Fail tls_sw_splice_read() after a failed async decrypt<\/p>\n
When an async decrypt fails, tls_decrypt_done() records the error <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17484","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17484","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17484"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17484"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17484"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}