CVE-2024-53091

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable code is reached only through local IPC — data arriving on an AF_UNIX stream socket or an AF_VSOCK socket that has been placed in a BPF sockmap — and the sockmap/SK_SKB setup requires local bpf() syscalls. Despite living in include/net/tls.h, no TLS/kTLS network peer is involved; the helper is simply misapplied to non-inet sockets.

AC:LAttack complexity, low

The attacker deterministically controls both the configuration (sockmap with stream_parser+stream_verdict, or the sk_skb_adjust_room helper) and the trigger (writing to the socket); no race and no uncontrolled memory layout is required. The confused offset is fixed and the fault reproduces reliably, as shown by the reporter's vsock-loopback repro.

PR:LPrivileges required, low

In the intended deployment for this feature — sockmap acceleration of AF_UNIX/vsock IPC set up by a privileged agent — an ordinary unprivileged local process triggers the OOB read merely by connecting and writing to the socket, and a guest VM can trigger the identical virtio_transport_recv_pkt path on the host. BPF tokens (6.9+) additionally let container runtimes delegate CAP_BPF/CAP_NET_ADMIN into an unprivileged user namespace, so real init-namespace root is not required.

UI:NUser interaction, none

No victim action is needed; the attacker performs both the sockmap attachment (or relies on an existing legitimate one) and the socket write that drives sk_data_ready into the confused helper.

S:UScope, unchanged

The out-of-bounds read, wild dereference and resulting oops are all confined to the host kernel's own security authority. No IOMMU, hypervisor, or sandbox boundary is crossed by the defect itself.

C:HConfidentiality impact, high

tls_get_ctx() reads 8 bytes at offset 1264 of a 1152-byte unix_sock — a genuine out-of-bounds read into an adjacent, heap-groomable slab object — and the resulting value is then dereferenced at +0x30, yielding an arbitrary-address read whose outcome steers control flow as an observable oracle.

I:HIntegrity impact, high

This is a type confusion (vsock_sock/unix_sock treated as inet_connection_sock), which per scoring guidance carries High integrity impact; concretely, a spuriously "true" tls_sw_has_ctx_rx() in sk_skb_adjust_room() writes rxm->full_len += len_diff into the skb control block, corrupting strparser length bookkeeping on a socket that has no TLS context.

A:HAvailability impact, high

The demonstrated result is an unhandled kernel page fault ("BUG: unable to handle page fault for address: 0000000000040030") inside a workqueue/softirq context, i.e. an oops that panics with panic_on_oops and otherwise kills the worker while holding sk_callback_lock and the socket lock, hanging the subsystem.