CVE-2024-0646

What it actually does

Out-of-bounds memory write in the Linux kernel kTLS implementation triggered when a local user invokes splice() with a ktls socket as the destination, resulting in memory corruption that can lead to kernel crash or privilege escalation.

Why it matters to the business

Local attackers on affected Linux systems can cause denial of service through crashes or obtain elevated privileges, potentially compromising servers, containers, and developer workstations that rely on the kernel TLS stack.

How an attack unfolds

An attacker with a local account creates a ktls socket, prepares malicious parameters for the splice system call targeting that socket, and triggers the out-of-bounds write to corrupt kernel memory structures for privilege escalation.

How to fix it

Upgrade the Linux kernel to a version containing commit c5a595000e267 or later; rebuild and reboot with the patched kernel. Where immediate patching is not possible, restrict untrusted local accounts and disable kTLS where feasible.

How to confirm the fix worked

Verify the running kernel contains commit c5a595000e267 or a backport; attempt to reproduce the splice call in a controlled test environment and confirm no oops or escalation occurs; review kernel build logs for the fix.

Typical attack path

1. Obtain local unprivileged shell access on a vulnerable Linux system
2. Create a ktls socket and configure it for TLS offload
3. Invoke splice() with crafted file descriptors and offsets pointing to the ktls socket as destination
4. Trigger the out-of-bounds write to corrupt kernel memory
5. Leverage corruption for kernel code execution or credential manipulation to gain root

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for oops or panic messages involving kTLS or splice; correlate with user processes performing unusual socket and splice operations; review audit logs for privilege changes following splice activity.

What your security team should do

• Prioritize kernel updates on all production and developer systems within the next maintenance window
• Limit local user accounts and enforce least privilege to reduce attack surface
• Monitor kernel logs for TLS-related oops and crashes as an interim detection measure
• Test the patched kernel in staging before broad deployment