CVE-2024-0646

high

Description

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5a595000e267

https://bugzilla.redhat.com/show_bug.cgi?id=2253908

https://access.redhat.com/security/cve/CVE-2024-0646

https://access.redhat.com/errata/RHSA-2024:2094

https://access.redhat.com/errata/RHSA-2024:1404

https://access.redhat.com/errata/RHSA-2024:1382

https://access.redhat.com/errata/RHSA-2024:1377

https://access.redhat.com/errata/RHSA-2024:1368

https://access.redhat.com/errata/RHSA-2024:1367

https://access.redhat.com/errata/RHSA-2024:1306

https://access.redhat.com/errata/RHSA-2024:1278

https://access.redhat.com/errata/RHSA-2024:1269

https://access.redhat.com/errata/RHSA-2024:1268

https://access.redhat.com/errata/RHSA-2024:1253

https://access.redhat.com/errata/RHSA-2024:1251

https://access.redhat.com/errata/RHSA-2024:1250

https://access.redhat.com/errata/RHSA-2024:1248

https://access.redhat.com/errata/RHSA-2024:0897

https://access.redhat.com/errata/RHSA-2024:0881

https://access.redhat.com/errata/RHSA-2024:0876

https://access.redhat.com/errata/RHSA-2024:0851

https://access.redhat.com/errata/RHSA-2024:0850

https://access.redhat.com/errata/RHSA-2024:0725

https://access.redhat.com/errata/RHSA-2024:0724

https://access.redhat.com/errata/RHSA-2024:0723

Details

Source: Mitre, NVD

Published: 2024-01-17

Updated: 2024-10-16

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High