CVE-2023-52767

What it actually does

NULL pointer dereference in the kernel TLS send path when tls_sw_splice_eof processes empty plaintext or ciphertext sk_msg buffers during sendfile, causing tls_push_record to incorrectly take the split path and reach tls_merge_open_record which assumes a populated buffer element.

Why it matters to the business

Linux systems performing TLS-encrypted file transfers via sendfile may experience kernel crashes resulting in denial of service and service disruption; widespread impact due to high prevalence of the Linux kernel in servers and devices.

How an attack unfolds

An attacker triggers the vulnerable code path by performing sendfile operations on a TLS socket under conditions that leave plaintext and ciphertext buffers empty after prior tls_trim_both_msgs bailouts, leading the kernel to dereference a NULL pointer in tls_merge_open_record.

How to fix it

Upgrade the Linux kernel to version 6.6.4 or apply the fix from commit 944900fe2736c07288efe2d9394db4d3ca23f2c9 in the stable tree; ensure all affected stable branches receive the patch.

How to confirm the fix worked

Confirm the running kernel version is 6.6.4 or newer; exercise TLS sendfile workloads and verify absence of oops/panic referencing tls_sw_splice_eof or tls_merge_open_record.

Typical attack path

1. Establish a TLS connection and reach a state with empty sk_msg buffers via prior sendmsg trimming
2. Invoke sendfile on the TLS socket to call tls_sw_splice_eof
3. Force tls_push_record onto the incorrect split=true path
4. Reach tls_merge_open_record with no populated buffer elements
5. Trigger NULL dereference and kernel panic

How to detect it

Inspect kernel logs and oops reports for entries mentioning tls_sw_splice_eof, tls_push_record, or tls_merge_open_record around the time of unexpected reboots or panics.

What your security team should do

• Prioritize kernel updates on all systems using TLS sendfile
• Apply patches within standard maintenance windows given low EPSS and no KEV listing
• Monitor kernel logs for TLS-related crashes until patching is complete
• Consider temporary restrictions on sendfile over TLS sockets where feasible