CVE-2024-58239 - tls: stop recv() if initial process_rx_list gave us non-DATA

Back Back to CVE browser

HIGH

tls: stop recv() if initial process_rx_list gave us non-DATA

Published Aug 22, 2025

8.2

HIGH

CVSS 3.1

EPSS 0.35%

Description

If we have a non-DATA record on the rx_list and another record of the same type still on the queue, we will end up merging them: - process_rx_list copies the non-DATA record - we start the loop and process the first available record since it's of the same type - we break out of the loop since the record was not DATA

Just check the record type and jump to the end in case process_rx_list did some work.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.1
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.1
- Version
  5.10.211
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.150
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.4.270
  Status
  unaffected
  Constraints
  <=5.4.*
- Version
  6.1.80
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.6.19
  Status
  unaffected
  Constraints
  <=6.6.*
- Version
  6.7.7
  Status
  unaffected
  Constraints
  <=6.7.*
- Version
  6.8
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
5.1	affected	-
0	unaffected	<5.1
5.10.211	unaffected	<=5.10.*
5.15.150	unaffected	<=5.15.*
5.4.270	unaffected	<=5.4.*
6.1.80	unaffected	<=6.1.*
6.6.19	unaffected	<=6.6.*
6.7.7	unaffected	<=6.7.*
6.8	unaffected	<=*

Red Hat Enterprise Linux 9

kernel-0:5.14.0-503.11.1.el9_5

Fixed · RHSA-2024:9315
Red Hat Enterprise Linux 9

kernel-0:5.14.0-503.11.1.el9_5

Fixed · RHSA-2024:9315
Red Hat Enterprise Linux 10

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Fix deferred
Red Hat Enterprise Linux 8

kernel-rt

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 9	kernel-0:5.14.0-503.11.1.el9_5	Fixed	RHSA-2024:9315
Red Hat Enterprise Linux 9	kernel-0:5.14.0-503.11.1.el9_5	Fixed	RHSA-2024:9315
Red Hat Enterprise Linux 10	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 8	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a

Remediation

Red Hat statement

The TLS recv path could mistakenly continue processing after process_rx_list() copied a non-DATA record, leading to merging of adjacent control records and inconsistent semantics. The fix makes recvmsg() stop immediately if the first processed record isn’t application data, preventing misinterpretation of TLS alerts/handshakes as data flow. Exploitation requires kTLS to be enabled and carefully crafted record sequencing, so the practical impact is limited to minor DoS of a TLS socket rather than confidentiality or integrity compromise.

Weaknesses (1)

CWE-241

References (13)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2024-58239		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2390320		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-55006		Advisory
https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276		Patch
https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f		Patch
https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09		Patch
https://git.kernel.org/stable/c/6756168add1c6c3ef1c32c335bb843a5d1f99a75		Patch
https://git.kernel.org/stable/c/a4ed943882a8fc057ea5a67643314245e048bbdd		Patch
https://git.kernel.org/stable/c/f310143961e2d9a0479fca117ce869f8aaecc140		Patch
https://git.kernel.org/stable/c/fdfbaec5923d9359698cbb286bc0deadbb717504		Patch
https://lore.kernel.org/linux-cve-announce/2025082210-CVE-2024-58239-dd4f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-58239
https://www.cve.org/CVERecord?id=CVE-2024-58239