Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

Summary

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Timeline

1. Jan 17, 2024, 3:16 PM UTCCVE published
2. May 10, 2024, 4:00 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Aug 6, 2026, 10:24 PM UTCRecord last updated

Affected versions

• kernel

  fixed in 6.7-rc5

• kernel-rt

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kpatch-patch

  Version range not reported

• kernel

  Version range not reported

• openshift-logging/cluster-logging-operator-bundle

  Version range not reported

• openshift-logging/cluster-logging-rhel9-operator

  Version range not reported

• openshift-logging/elasticsearch6-rhel9

  Version range not reported

• openshift-logging/elasticsearch-operator-bundle

  Version range not reported

• openshift-logging/elasticsearch-proxy-rhel9

  Version range not reported

• openshift-logging/elasticsearch-rhel9-operator

  Version range not reported

• openshift-logging/eventrouter-rhel9

  Version range not reported

• openshift-logging/fluentd-rhel9

  Version range not reported

• openshift-logging/log-file-metric-exporter-rhel9

  Version range not reported

• openshift-logging/logging-curator5-rhel9

  Version range not reported

• openshift-logging/logging-loki-rhel9

  Version range not reported

• openshift-logging/logging-view-plugin-rhel9

  Version range not reported

• openshift-logging/loki-operator-bundle

  Version range not reported

• openshift-logging/loki-rhel9-operator

  Version range not reported

• openshift-logging/lokistack-gateway-rhel9

  Version range not reported

• openshift-logging/opa-openshift-rhel9

  Version range not reported

• openshift-logging/vector-rhel9

  Version range not reported

• kernel

  Version range not reported

• kernel

  Version range not reported

• kernel-rt

  Version range not reported

• kernel-rt

  Version range not reported

References 25