CVE-2024-58240

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58240", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:19:43.804Z", "datePublished": "2025-08-28T09:40:33.466Z", "dateUpdated": "2026-10-15T21:51:51.694Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:27:47.491Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: separate no-async decryption request handling from async\n\nIf we're not doing async, the handling is much simpler. There's no\nreference counting, we just need to wait for the completion to wake us\nup and return its result.\n\nWe should preferably also use a separate crypto_wait. I'm not seeing a\nUAF as I did in the past, I think aec7961916f3 (\"tls: fix race between\nasync notify and socket close\") took care of it.\n\nThis will make the next fix easier."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is kTLS record decryption (net/tls/tls_sw.c), driven entirely by TLS records arriving on a TCP socket from a remote peer or an on-path injector. Per kernel scoring guidance, kTLS bugs triggered by remote peer data are Network.\nAC:L - The remote peer controls every input to the race \u2014 record type (DATA\u2192async vs. alert/handshake\u2192sync), record rate (to fill the crypto backlog and force -EBUSY), and authentication failure (-EBADMSG) \u2014 so it creates both sides of the race and can retry indefinitely on a long-lived connection. Async AEAD (SIMD/cryptd AES-GCM, QAT, Chelsio) with TLS 1.2 is a normal kTLS deployment, not a rare config.\nPR:N - The attacker is the remote TLS peer of a kTLS socket (e.g. an anonymous client of an nginx/HAProxy/NVMe-TCP-TLS server) or an on-path attacker injecting records into an established connection, and holds no credentials or privileges on the target system. No authentication gate exists on the receive path.\nUI:N - Triggering requires only that the kTLS-enabled application perform its normal recvmsg() on the socket while the attacker sends crafted record sequences. No victim action beyond ordinary server operation is needed.\nS:U - The corruption is kernel heap and page memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The still-queued aead_request, its scatterlists and the output pages are freed and reallocated while the crypto engine continues to use them, giving an attacker who sprays the freed slab both a read primitive over reused kernel memory and plaintext written into unrelated allocations; additionally a lost -EBADMSG can leak a failed record's contents to userspace.\nI:H - The crypto driver writes decrypted output into kfree()'d memory and put_page()'d pages after they may be reallocated, an attacker-influenced out-of-bounds write usable for heap grooming and control-flow hijack; the clobbered ctx->async_wait.err can also suppress an authentication failure and admit forged record data.\nA:H - The use-after-free readily oopses or panics the kernel, and the mis-attributed completion leaves recvmsg() blocked forever in uninterruptible wait_for_completion() holding the socket lock, producing an unkillable D-state task and a permanently wedged socket."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tls/tls_sw.c"], "versions": [{"version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "f32ab6cb544d01cdc150de5df389ac685aa507b0", "status": "affected", "versionType": "git"}, {"version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "5f7761c94b1db7570cab328c9f940a33284509b7", "status": "affected", "versionType": "git"}, {"version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "48905146d11dbf1ddbb2967319016a83976953f5", "status": "affected", "versionType": "git"}, {"version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "dec5b6e7b211e405d3bcb504562ab21aa7e5a64d", "status": "affected", "versionType": "git"}, {"version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "999115298017a675d8ddf61414fc7a85c89f1186", "status": "affected", "versionType": "git"}, {"version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "41532b785e9d79636b3815a64ddf6a096647d011", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tls/tls_sw.c"], "versions": [{"version": "4.13", "status": "affected"}, {"version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.1.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.7.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f32ab6cb544d01cdc150de5df389ac685aa507b0"}, {"url": "https://git.kernel.org/stable/c/5f7761c94b1db7570cab328c9f940a33284509b7"}, {"url": "https://git.kernel.org/stable/c/48905146d11dbf1ddbb2967319016a83976953f5"}, {"url": "https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d"}, {"url": "https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186"}, {"url": "https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011"}], "title": "tls: separate no-async decryption request handling from async", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:31:32.503Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:02:08.000Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58240", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:32.212758Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:51.694Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:31:32.503Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:02:08.000Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58240", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:32.212758Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:42:32.799Z"}}], "cna": {"title": "tls: separate no-async decryption request handling from async", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is kTLS record decryption (net/tls/tls_sw.c), driven entirely by TLS records arriving on a TCP socket from a remote peer or an on-path injector. Per kernel scoring guidance, kTLS bugs triggered by remote peer data are Network.\nAC:L - The remote peer controls every input to the race \u2014 record type (DATA\u2192async vs. alert/handshake\u2192sync), record rate (to fill the crypto backlog and force -EBUSY), and authentication failure (-EBADMSG) \u2014 so it creates both sides of the race and can retry indefinitely on a long-lived connection. Async AEAD (SIMD/cryptd AES-GCM, QAT, Chelsio) with TLS 1.2 is a normal kTLS deployment, not a rare config.\nPR:N - The attacker is the remote TLS peer of a kTLS socket (e.g. an anonymous client of an nginx/HAProxy/NVMe-TCP-TLS server) or an on-path attacker injecting records into an established connection, and holds no credentials or privileges on the target system. No authentication gate exists on the receive path.\nUI:N - Triggering requires only that the kTLS-enabled application perform its normal recvmsg() on the socket while the attacker sends crafted record sequences. No victim action beyond ordinary server operation is needed.\nS:U - The corruption is kernel heap and page memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The still-queued aead_request, its scatterlists and the output pages are freed and reallocated while the crypto engine continues to use them, giving an attacker who sprays the freed slab both a read primitive over reused kernel memory and plaintext written into unrelated allocations; additionally a lost -EBADMSG can leak a failed record's contents to userspace.\nI:H - The crypto driver writes decrypted output into kfree()'d memory and put_page()'d pages after they may be reallocated, an attacker-influenced out-of-bounds write usable for heap grooming and control-flow hijack; the clobbered ctx->async_wait.err can also suppress an authentication failure and admit forged record data.\nA:H - The use-after-free readily oopses or panics the kernel, and the mis-attributed completion leaves recvmsg() blocked forever in uninterruptible wait_for_completion() holding the socket lock, producing an unkillable D-state task and a permanently wedged socket."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "f32ab6cb544d01cdc150de5df389ac685aa507b0", "versionType": "git"}, {"status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "5f7761c94b1db7570cab328c9f940a33284509b7", "versionType": "git"}, {"status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "48905146d11dbf1ddbb2967319016a83976953f5", "versionType": "git"}, {"status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "dec5b6e7b211e405d3bcb504562ab21aa7e5a64d", "versionType": "git"}, {"status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "999115298017a675d8ddf61414fc7a85c89f1186", "versionType": "git"}, {"status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "lessThan": "41532b785e9d79636b3815a64ddf6a096647d011", "versionType": "git"}], "programFiles": ["net/tls/tls_sw.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"status": "unaffected", "version": "0", "lessThan": "4.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.149", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.21", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.9", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/tls/tls_sw.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f32ab6cb544d01cdc150de5df389ac685aa507b0"}, {"url": "https://git.kernel.org/stable/c/5f7761c94b1db7570cab328c9f940a33284509b7"}, {"url": "https://git.kernel.org/stable/c/48905146d11dbf1ddbb2967319016a83976953f5"}, {"url": "https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d"}, {"url": "https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186"}, {"url": "https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: separate no-async decryption request handling from async\n\nIf we're not doing async, the handling is much simpler. There's no\nreference counting, we just need to wait for the completion to wake us\nup and return its result.\n\nWe should preferably also use a separate crypto_wait. I'm not seeing a\nUAF as I did in the past, I think aec7961916f3 (\"tls: fix race between\nasync notify and socket close\") took care of it.\n\nThis will make the next fix easier."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.149", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.21", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.9", "versionStartIncluding": "4.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "4.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:27:47.491Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58240", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:51.694Z", "dateReserved": "2025-04-16T07:19:43.804Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-08-28T09:40:33.466Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tls/tls_sw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f32ab6cb544d01cdc150de5df389ac685aa507b0", "status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "versionType": "git"}, {"lessThan": "5f7761c94b1db7570cab328c9f940a33284509b7", "status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "versionType": "git"}, {"lessThan": "48905146d11dbf1ddbb2967319016a83976953f5", "status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "versionType": "git"}, {"lessThan": "dec5b6e7b211e405d3bcb504562ab21aa7e5a64d", "status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "versionType": "git"}, {"lessThan": "999115298017a675d8ddf61414fc7a85c89f1186", "status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "versionType": "git"}, {"lessThan": "41532b785e9d79636b3815a64ddf6a096647d011", "status": "affected", "version": "3c4d7559159bfe1e3b94df3a657b2cda3a34e218", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tls/tls_sw.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"lessThan": "4.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.149", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.21", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC CN 4100", "vendor": "Siemens", "versions": [{"lessThan": "V5.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8B7DA04-A2AD-4FA0-AEDC-03DD7814BE3A", "versionEndExcluding": "6.1.149", "versionStartIncluding": "4.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B19074A2-9FE5-4E7D-9E2D-020F95013ADA", "versionEndExcluding": "6.6.21", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C538467-EDA0-4A9A-82EB-2925DE9FF827", "versionEndExcluding": "6.7.9", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*", "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*", "matchCriteriaId": "AEB9199B-AB8F-4877-8964-E2BA95B5F15C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: separate no-async decryption request handling from async\n\nIf we're not doing async, the handling is much simpler. There's no\nreference counting, we just need to wait for the completion to wake us\nup and return its result.\n\nWe should preferably also use a separate crypto_wait. I'm not seeing a\nUAF as I did in the past, I think aec7961916f3 (\"tls: fix race between\nasync notify and socket close\") took care of it.\n\nThis will make the next fix easier."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntls: separar el manejo de solicitudes de descifrado no as\u00edncronas del as\u00edncrono\n\nSi no estamos haciendo as\u00edncrono, el manejo es mucho m\u00e1s simple. No hay conteo de referencias; solo necesitamos esperar a que la finalizaci\u00f3n nos despierte y devuelva su resultado.\n\nPreferiblemente deber\u00edamos usar tambi\u00e9n un crypto_wait separado. No estoy viendo un UAF como lo hice en el pasado; creo que aec7961916f3 (\u201ctls: corregir condici\u00f3n de carrera entre notificaci\u00f3n as\u00edncrona y cierre de socket\u201d) se encarg\u00f3 de ello.\n\nEsto har\u00e1 la pr\u00f3xima correcci\u00f3n m\u00e1s f\u00e1cil."}], "id": "CVE-2024-58240", "lastModified": "2026-11-09T10:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58240", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:42:32.212758Z", "version": "2.0.3"}}]}, "published": "2025-08-28T10:15:31.780", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48905146d11dbf1ddbb2967319016a83976953f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f7761c94b1db7570cab328c9f940a33284509b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/999115298017a675d8ddf61414fc7a85c89f1186"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dec5b6e7b211e405d3bcb504562ab21aa7e5a64d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f32ab6cb544d01cdc150de5df389ac685aa507b0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: tls: separate no-async decryption request handling from async", "id": "2391431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391431"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-416", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."}, "name": "CVE-2024-58240", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-58240\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58240\nhttps://lore.kernel.org/linux-cve-announce/2025082836-CVE-2024-58240-b2b3@gregkh/T"], "statement": "This patch refactors TLS RX decryption to use a separate, stack-local crypto_wait for the non-async path and bypass the async reference-counting/notification logic. It doesn\u2019t fix a user-triggerable bug by itself; it\u2019s a correctness/simplification change that reduces coupling and prepares the ground for a follow-up fix (\u201ctls: fix use-after-free on failed backlog decryption\u201d). No externally exploitable behavior changes are introduced.\nThe bug is actual for the older versions of Red Hat Enterprise Linux (before 9.3 and for all versions of the Red Hat Enterprise Linux 8) where patch aec7961916f3 \"tls: fix race between async notify and socket close\" not backported yet.\nThe CVSS being calculated for worse case scenario where the previous patch aec7961916f3 not applied yet (that leads to the use after free possibility).", "threat_severity": "Moderate"}

{"created": "2025-08-28T21:21:51.470177+00:00", "updated": "2025-08-28T21:21:51.470251+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}