title: net: tls: fix use-after-free with partial reads and async decrypt
description: In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix use-after-free with partial reads and async decrypt
tls_decrypt_sg doesn't take a reference on the pages from clear_skb,
so the put_page() in tls_decrypt_done releases them, and we trigger
a use-after-free in process_rx_list when we try to read from the
partially-read skb.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: fd31f3996af2, lessThan: 20b4ed034872, status: affected, versionType: git
version: fd31f3996af2, lessThan: d684763534b9, status: affected, versionType: git
version: fd31f3996af2, lessThan: 754c9bab77a1, status: affected, versionType: git
version: fd31f3996af2, lessThan: 32b55c5ff910, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 6.0, status: affected
version: 0, lessThan: 6.0, status: unaffected, versionType: custom
version: 6.1.79, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.18, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.6, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
