// For flags

CVE-2021-47132

mptcp: fix sk_forward_memory corruption on retransmission

Severity Score

"-"
*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix sk_forward_memory corruption on retransmission

MPTCP sk_forward_memory handling is a bit special, as such field
is protected by the msk socket spin_lock, instead of the plain
socket lock.

Currently we have a code path updating such field without handling
the relevant lock:

__mptcp_retrans() -> __mptcp_clean_una_wakeup()

Several helpers in __mptcp_clean_una_wakeup() will update
sk_forward_alloc, possibly causing such field corruption, as reported
by Matthieu.

Address the issue providing and using a new variant of blamed function
which explicitly acquires the msk spin lock.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: corrige la corrupción de sk_forward_memory en la retransmisión El manejo de MPTCP sk_forward_memory es un poco especial, ya que dicho campo está protegido por el socket msk spin_lock, en lugar del bloqueo de socket simple. Actualmente tenemos una ruta de código que actualiza dicho campo sin manejar el bloqueo relevante: __mptcp_retrans() -> __mptcp_clean_una_wakeup() Varios ayudantes en __mptcp_clean_una_wakeup() actualizarán sk_forward_alloc, posiblemente causando dicha corrupción de campo, según lo informado por Matthieu. Solucione el problema proporcionando y utilizando una nueva variante de la función culpada que adquiere explícitamente el bloqueo de giro msk.

*Credits: N/A
CVSS Scores
Attack Vector
-
Attack Complexity
-
Privileges Required
-
User Interaction
-
Scope
-
Confidentiality
-
Integrity
-
Availability
-
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-03-04 CVE Reserved
  • 2024-03-15 CVE Published
  • 2024-03-16 EPSS Updated
  • 2024-12-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.12 < 5.12.10
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.12 < 5.12.10"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
>= 5.12 < 5.13
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.12 < 5.13"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
5.11.4
Search vendor "Linux" for product "Linux Kernel" and version "5.11.4"
en
Affected