Linux Kernel Slab-Out-Of-Bounds Vulnerability in TLS Decryption

A slab-out-of-bounds vulnerability has been identified in the Linux kernel's TLS implementation. This issue arises in the 'decrypt_internal' function, where the memory size of the initialization vector (IV) for AES128-CCM is incorrectly set to 12 bytes. However, the 'ccm(aes)' encryption scheme requires 16 bytes, leading to a buffer over-read. The vulnerability can be triggered when the 'tls_set_sw_offload' function is called, particularly in the context of TLS 1.3.

Impact

Exploitation of this vulnerability causes a slab-out-of-bounds memory access, which can lead to memory corruption.