Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

CVE-2024-0646

What is CVE-2024-0646?

The vulnerability arises from an out-of-bounds memory write flaw in the Linux kernel's Transport Layer Security (TLS) functionality, specifically during a user-initiated call to the splice function with a ktls socket as its destination. This flaw potentially allows a local user to crash the system or escalate their privileges, posing significant security risks to systems utilizing affected versions of the Linux kernel.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

News Articles

prophaze.com

CVE-2024-0646

CVE-2024-0646 : LINUX KERNEL TLS /NET/TLS/TLS_SW.C TLS_SW_SENDMSG_SPLICE OUT-OF-BOUNDS WRITE - Cloud WAF

CVE-2024-0646 : An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination.

References