Vulnerability · Published Jan 17, 2024 · Assigned by redhat

CVE-2024-0646Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

High 7.0

In plain English

A high-severity out-of-bounds write in kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.3%top 76.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bpftool	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-abi-stablelists	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-core	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-cross-headers	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-debug	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-debug-core	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-debug-devel	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-debug-modules	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-debug-modules-extra	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-devel	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-doc	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-modules	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-modules-extra	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-tools	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-tools-libs	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-tools-libs-devel	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-zfcpdump	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-zfcpdump-core	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-zfcpdump-devel	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-zfcpdump-modules	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	kernel-zfcpdump-modules-extra	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	perf	4.18.0-513.18.1.el8_9	ALSA-2024:0897
AlmaLinux:8	python3-perf	4.18.0-513.18.1.el8_9	ALSA-2024:0897
Debian:12	linux	6.1.69-1	DEBIAN-CVE-2024-0646
Debian:13	linux	6.6.8-1	DEBIAN-CVE-2024-0646
Debian:14	linux	6.6.8-1	DEBIAN-CVE-2024-0646
Rocky Linux:9	kernel	0:5.14.0-362.24.1.el9_3.cloud.0.6	RXSA-2024:1248
Ubuntu:22.04:LTS	linux	5.15.0-97.107	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux	5.15.0-97.107	USN-6653-1
Ubuntu:22.04:LTS	linux-allwinner-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-aws	5.15.0-1055.60	USN-6653-2
Ubuntu:22.04:LTS	linux-aws	5.15.0-1055.60	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-aws-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-aws-6.2	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-aws-6.5	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-azure	5.15.0-1057.65	USN-6653-1
Ubuntu:22.04:LTS	linux-azure	5.15.0-1057.65	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-azure-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-azure-6.2	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-azure-6.5	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1057.65.1	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1057.65.1	USN-6653-1
Ubuntu:22.04:LTS	linux-azure-fde-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-azure-fde-6.2	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1052.60	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1052.60	USN-6653-1
Ubuntu:22.04:LTS	linux-gcp-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-gcp-6.2	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-gcp-6.5	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-gke	5.15.0-1051.56	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-gke	5.15.0-1051.56	USN-6653-4
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1037.43	USN-6653-1
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1037.43	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-hwe-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-hwe-6.2	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-hwe-6.5	6.5.0-21.21~22.04.1	USN-6651-1
Ubuntu:22.04:LTS	linux-hwe-6.5	6.5.0-21.21~22.04.1	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1047.50	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1047.50	USN-6653-1
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1049.55	USN-6653-1
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1049.55	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1051.56	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1051.56	USN-6653-1
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-97.107	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-97.107	USN-6653-3
Ubuntu:22.04:LTS	linux-lowlatency-hwe-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.5	6.5.0-21.21.1~22.04.1	USN-6651-2
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.5	6.5.0-21.21.1~22.04.1	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1045.45	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1045.45	USN-6653-1
Ubuntu:22.04:LTS	linux-nvidia-6.2	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-nvidia-6.5	6.5.0-1014.14	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-nvidia-tegra	5.15.0-1022.22	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-nvidia-tegra-igx	5.15.0-1009.9	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-oem-5.17	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-oem-6.0	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1033.33	USN-6639-1
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1033.33	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-oem-6.5	6.5.0-1015.16	USN-6651-2
Ubuntu:22.04:LTS	linux-oem-6.5	6.5.0-1015.16	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1052.58	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1052.58	USN-6653-1
Ubuntu:22.04:LTS	linux-oracle-6.5	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1047.50	USN-6653-1
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1047.50	UBUNTU-CVE-2024-0646
Ubuntu:24.04:LTS	linux-raspi-realtime	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-realtime	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-riscv	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-riscv-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-riscv-6.5	6.5.0-21.21.1~22.04.1	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-starfive-5.19	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-starfive-6.2	no fix listed	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-starfive-6.5	6.5.0-1008.9~22.04.1	UBUNTU-CVE-2024-0646
Ubuntu:22.04:LTS	linux-starfive-6.5	6.5.0-1008.9~22.04.1	USN-6651-3
Ubuntu:22.04:LTS	linux-xilinx-zynqmp	5.15.0-1030.34	UBUNTU-CVE-2024-0646

Affected products (as reported)

Vendor	Product	Versions
	kernel	0 – before 6.7-rc5
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	see references
Red Hat	RHOL-5.8-RHEL-9	see references
Red Hat	RHOL-5.8-RHEL-9	see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2024:0723 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0724 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0725 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0850 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0851 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0876 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0881 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0897 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1248 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1250 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1251 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1253 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1268 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1269 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1278 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1306 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1367 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1368 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1377 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1382 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1404 vendor-advisory, x_refsource_REDHAT
RHSA-2024:2094 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-0646 vdb-entry, x_refsource_REDHAT
RHBZ#2253908 issue-tracking, x_refsource_REDHAT
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5a595000e267
https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html x_transferred