Linux Kernel TLS Chain-After-Chain Vulnerability in Scatterlist API

A vulnerability in the Linux kernel's TLS implementation can lead to an illegal input scenario in the scatterlist API. This issue arises when the 'end' parameter is 0 while 'start' is not, causing a wrap link to point directly to another chain link. The scatterlist API's iterator does not properly resolve consecutive chain links, creating a chain-after-chain situation that is problematic for crypto operations. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can disrupt proper TLS 1.3 chaining, potentially leading to incorrect handling of encrypted data.

Reproduction

The vulnerability can be reproduced by creating a TLS 1.3 record where the scatterlist 'end' is set to 0 and 'start' is not. This configuration will cause the wrap link to improperly chain to the content type, creating a chain-after-chain scenario that the scatterlist API cannot resolve.

Remediation

Users can update to the latest version of the Linux kernel stable tree, where this vulnerability has been addressed.