CVE-2021-47496

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/tls: Fix flipped sign in tls_err_abort() calls

sk->sk_err appears to expect a positive value, a convention that ktls

doesn't always follow and that leads to memory corruption in other code.

For instance,

[kworker]

tls_encrypt_done(..., err=<negative error from crypto request>)

tls_err_abort(.., err)

sk->sk_err = err;

[task]

splice_from_pipe_feed

...

tls_sw_do_sendpage

if (sk->sk_err) {

ret = -sk->sk_err; // ret is positive

splice_from_pipe_feed (continued)

ret = actor(...) // ret is still positive and interpreted as bytes

// written, resulting in underflow of buf->len and

// sd->len, leading to huge buf->offset and bogus

// addresses computed in later calls to actor()

Fix all tls_err_abort() callers to pass a negative error code

consistently and centralize the e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References