CVE-2023-52767: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52767 is a vulnerability in the Linux kernel's TLS implementation, discovered by syzkaller. The issue was identified in Linux kernel versions from 6.5 up to (excluding) 6.6.4, and in versions 6.7-rc1 and 6.7-rc2. The vulnerability was reported on May 21, 2024, and involves a NULL pointer dereference in the tls_sw_splice_eof() function when handling empty records (NVD).

The vulnerability occurs when tls_sw_splice_eof() is executed as part of sendfile() operation with empty plaintext/ciphertext sk_msg. The empty ciphertext buffer lacks space for encryption overhead, causing tls_push_record() to enter the 'split = true' path, which should only occur when interacting with an attached BPF program. This leads to tls_merge_open_record() assuming at least one populated buffer element exists, resulting in a NULL pointer dereference. The condition can arise when previously exiting from tls_sw_sendmsg_locked() via the tls_trim_both_msgs() path (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a NULL pointer dereference in the Linux kernel, potentially causing system crashes or denial of service conditions when processing TLS connections using the sendfile() operation (NVD).

The vulnerability requires local access and can be triggered through the sendfile() operation when handling empty TLS records. It was discovered and reported by syzkaller, Google's automated kernel fuzzing tool (Kernel Patch).

The vulnerability has been patched in the Linux kernel. The fix involves adding a check in tls_sw_splice_eof() to handle empty records correctly, similar to the existing check in tls_sw_push_pending_record(). The patch has been merged into the kernel codebase (Kernel Patch).