oss-security - CVE-2023-1075 - Linux Kernel: Type Confusion in tls_is_tx

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAEih1qWzJSX8z4dx958nqFH=FX3Z2A2jgAwd0kBv0gGpidSeuw@mail.gmail.com>
Date: Wed, 1 Mar 2023 16:23:54 +0100
From: Pietro Borrello <borrello@...g.uniroma1.it>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-1075 - Linux Kernel: Type Confusion in tls_is_tx_ready()

Hi all,

I am disclosing a type confusion in the net/tls stack of the Linux Kernel.
tls_is_tx_ready() checks that list_first_entry() does not return NULL.
However, this condition can never happen.
For an empty `tx_list`, list_first_entry() returns the list_entry() of the head,
which, when used, is a type confusion.
Thus, tls_is_tx_ready() may potentially use a type-confused entry
to the list_head, leaking the last byte of the type confused field
that overlaps with rec->tx_ready.

The patch has been merged in the Linux tree:
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=ffe2a22562444720b05bdfeb999c03e810d84cbb

The issue has been assigned CVE-2023-1075.

Best regards,
Pietro Borrello

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.