// For flags

CVE-2024-53122

mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

Severity Score

"-"
*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

Additional active subflows - i.e. created by the in kernel path
manager - are included into the subflow list before starting the
3whs.

A racing recvmsg() spooling data received on an already established
subflow would unconditionally call tcp_cleanup_rbuf() on all the
current subflows, potentially hitting a divide by zero error on
the newly created ones.

Explicitly check that the subflow is in a suitable state before
invoking tcp_cleanup_rbuf().

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: creación de subflujo de ejecución en mptcp_rcv_space_adjust Los subflujos activos adicionales (es decir, creados por el administrador de rutas en el kernel) se incluyen en la lista de subflujos antes de iniciar 3whs. Un recvmsg() de ejecución que pone en cola los datos recibidos en un subflujo ya establecido llamaría incondicionalmente a tcp_cleanup_rbuf() en todos los subflujos actuales, lo que podría provocar un error de división por cero en los recién creados. Verifique explícitamente que el subflujo esté en un estado adecuado antes de invocar tcp_cleanup_rbuf().

*Credits: N/A
CVSS Scores
Attack Vector
-
Attack Complexity
-
Privileges Required
-
User Interaction
-
Scope
-
Confidentiality
-
Integrity
-
Availability
-
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2024-11-19 CVE Reserved
  • 2024-12-02 CVE Published
  • 2024-12-02 CVE Updated
  • ---------- EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 5.10 < 6.1.119
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.10 < 6.1.119"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 5.10 < 6.6.63
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.10 < 6.6.63"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 5.10 < 6.11.10
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.10 < 6.11.10"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 5.10 < 6.12
Search vendor "Linux" for product "Linux Kernel" and version " >= 5.10 < 6.12"
en
Affected