In the Linux kernel, the following vulnerability has been resolved:
mptcp: ensure snd_nxt is properly initialized on connect
Christoph reported a splat hinting at a corrupted snd_una:
WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Modules linked in: CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8 8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe <0f> 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9 RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4 RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000 R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000 FS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0 Call Trace: <TASK> __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline] mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline] __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615 mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767 process_one_work+0x1e0/0x560 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x3c7/0x640 kernel/workqueue.c:3416 kthread+0x121/0x170 kernel/kthread.c:388 ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 </TASK>
When fallback to TCP happens early on a client socket, snd_nxt is not yet initialized and any incoming ack will copy such value into snd_una. If the mptcp worker (dumbly) tries mptcp-level re-injection after such ack, that would unconditionally trigger a send buffer cleanup using 'bad' snd_una values.
We could easily disable re-injection for fallback sockets, but such dumb behavior already helped catching a few subtle issues and a very low to zero impact in practice.
Instead address the issue always initializing snd_nxt (and write_seq, for consistency) at connect time.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-headersUpgrade kernel-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-devel-matchedUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64kUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-modules-coreUpgrade kernel-cross-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade libperfUpgrade kernel-rt-modules-extraUpgrade rtlaUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debugUpgrade kernelUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-coreUpgrade kernel-debug-develUpgrade kernel-64k-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-rt-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-uki-virtUpgrade kernel-zfcpdumpUpgrade python3-perfUpgrade bpftoolUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-rt-modulesUpgrade rvUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-docUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-coreUpgrade perf | Aug 12, 2024 | May 30, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.218-206.860Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernelUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.160-104.158Upgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-develUpgrade kernel-headers | Jun 12, 2024 | May 30, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-modules-extra-commonUpgrade kernel-develUpgrade kernel-livepatch-6.1.91-99.172Upgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernelUpgrade kernel-headers | Feb 17, 2025 | May 30, 2024 |
| Debian | — | Upgrade linux | Jun 4, 2024 | May 30, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | May 30, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Aug 12, 2024 | May 30, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-debuginfoUpgrade kernel-coreUpgrade kernel-cross-headersUpgrade libperfUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-develUpgrade kernel-devel-matchedUpgrade kernel-debug-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-uki-virtUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade kernelUpgrade kernel-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade perf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-headersUpgrade kernel-modules-coreUpgrade kernel-rt-modules-coreUpgrade bpftool-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade libperf-debuginfoUpgrade kernel-rt-debuginfoUpgrade perfUpgrade kernel-rt-debugUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade rvUpgrade kernel-rt-kvmUpgrade kernel-tools-libsUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade python3-perf-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-tools-debuginfoUpgrade kernel-rt-develUpgrade python3-perfUpgrade kernel-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debug-debuginfoUpgrade bpftoolUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modules-core | Aug 22, 2024 | May 30, 2024 |
| Suse | — | Upgrade ocfs2-kmp-defaultUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade dtb-nvidiaUpgrade kernel-sourceUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatchUpgrade dtb-armUpgrade dtb-xilinxUpgrade kernel-default-vdsoUpgrade kernel-devel-rtUpgrade kernel-symsUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade dtb-mediatekUpgrade dtb-allwinnerUpgrade kernel-obs-qaUpgrade kernel-kvmsmallUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-rtUpgrade dtb-apmUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-develUpgrade dtb-sprdUpgrade kernel-debugUpgrade dlm-kmp-azureUpgrade kernel-develUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-azureUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade dtb-exynosUpgrade kernel-default-optionalUpgrade ocfs2-kmp-rtUpgrade dtb-rockchipUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-azureUpgrade dtb-amlogicUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-extraUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-rtUpgrade dtb-caviumUpgrade dtb-amdUpgrade kernel-source-azureUpgrade kernel-debug-vdsoUpgrade kernel-rt_debugUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade dtb-hisiliconUpgrade kernel-obs-buildUpgrade kernel-source-rtUpgrade dtb-marvellUpgrade kernel-source-vanillaUpgrade gfs2-kmp-defaultUpgrade kernel-azureUpgrade kernel-rt-extraUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade dtb-amazonUpgrade kernel-rt_debug-develUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade dtb-lgUpgrade dtb-appleUpgrade dtb-alteraUpgrade kernel-default-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-azure-develUpgrade kernel-syms-rtUpgrade dtb-renesasUpgrade kernel-zfcpdumpUpgrade kernel-docs-htmlUpgrade dtb-freescaleUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-livepatch-devel | Aug 8, 2024 | May 30, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1050-gkeopUpgrade linux-image-virtualUpgrade linux-image-5.15.0-118-generic-lpaeUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-5.15.0-118-lowlatency-64kUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oracleUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-1067-awsUpgrade linux-image-5.15.0-1064-kvmUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1060-raspiUpgrade linux-image-5.15.0-1062-nvidiaUpgrade linux-image-azure-cvmUpgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-118-generic-64kUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-118-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-5.15.0-1062-intel-iotgUpgrade linux-image-5.15.0-1064-gkeUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-oem-20.04dUpgrade linux-image-intelUpgrade linux-image-ibm-classicUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1065-oracleUpgrade linux-image-5.15.0-1070-azureUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-5.15.0-1066-gcpUpgrade linux-image-5.15.0-1062-nvidia-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-oem-20.04Upgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-gkeop-5.15Upgrade linux-image-gkeopUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1010-oemUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1070-azure-fdeUpgrade linux-image-5.15.0-1060-ibmUpgrade linux-image-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-5.15.0-118-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-gke-5.15Upgrade linux-image-oem-24.04Upgrade linux-image-azureUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-oem-20.04b | Aug 9, 2024 | May 30, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 30, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub