Linux Kernel Off-By-One Vulnerability in TLS Scatterlist Handling

An off-by-one vulnerability has been identified in the Linux kernel's handling of TLS scatterlist rings within the networking subsystem. This issue arises when the scatterlist ring wraps, causing the current implementation to miscalculate the entry count for chaining data. The vulnerability is present in the stable branch of the Linux kernel.

Impact

Exploitation of this vulnerability could lead to improper handling of TLS data, potentially causing corruption or mismanagement of encrypted records.

Reproduction

The vulnerability can be reproduced by creating a scenario where the sk_msg scatterlist ring wraps, with the end pointer falling before the start pointer. This can be achieved by manipulating the scatterlist entries in such a way that the tail portion of the ring needs to be chained back to the head, triggering the off-by-one error in the entry count.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.