In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix double-free on socket dismantle
when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inet_opt' for the new socket has the same value as the original one: as a consequence, on program exit it's possible to observe the following splat:
BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0 Free of addr ffff888485950880 by task swapper/25/0
CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609 Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0 07/26/2013 Call Trace: <IRQ> dump_stack_lvl+0x32/0x50 print_report+0xca/0x620 kasan_report_invalid_free+0x64/0x90 __kasan_slab_free+0x1aa/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x54f/0x8b0 __sk_destruct+0x48/0x5b0 rcu_do_batch+0x34e/0xd90 rcu_core+0x559/0xac0 __do_softirq+0x183/0x5a4 irq_exit_rcu+0x12d/0x170 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x16/0x20 RIP: 0010:cpuidle_enter_state+0x175/0x300 Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed <0f> 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000 RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588 RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080 R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0 R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80 cpuidle_enter+0x4a/0xa0 do_idle+0x310/0x410 cpu_startup_entry+0x51/0x60 start_secondary+0x211/0x270 secondary_startup_64_no_verify+0x184/0x18b </TASK>
Allocated by task 6853: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0xa6/0xb0 __kmalloc+0x1eb/0x450 cipso_v4_sock_setattr+0x96/0x360 netlbl_sock_setattr+0x132/0x1f0 selinux_netlbl_socket_post_create+0x6c/0x110 selinux_socket_post_create+0x37b/0x7f0 security_socket_post_create+0x63/0xb0 __sock_create+0x305/0x450 __sys_socket_create.part.23+0xbd/0x130 __sys_socket+0x37/0xb0 __x64_sys_socket+0x6f/0xb0 do_syscall_64+0x83/0x160 entry_SYSCALL_64_after_hwframe+0x6e/0x76
Freed by task 6858: kasan_save_stack+0x1c/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x12c/0x1f0 kfree+0xed/0x2e0 inet_sock_destruct+0x54f/0x8b0 __sk_destruct+0x48/0x5b0 subflow_ulp_release+0x1f0/0x250 tcp_cleanup_ulp+0x6e/0x110 tcp_v4_destroy_sock+0x5a/0x3a0 inet_csk_destroy_sock+0x135/0x390 tcp_fin+0x416/0x5c0 tcp_data_queue+0x1bc8/0x4310 tcp_rcv_state_process+0x15a3/0x47b0 tcp_v4_do_rcv+0x2c1/0x990 tcp_v4_rcv+0x41fb/0x5ed0 ip_protocol_deliver_rcu+0x6d/0x9f0 ip_local_deliver_finish+0x278/0x360 ip_local_deliver+0x182/0x2c0 ip_rcv+0xb5/0x1c0 __netif_receive_skb_one_core+0x16e/0x1b0 process_backlog+0x1e3/0x650 __napi_poll+0xa6/0x500 net_rx_action+0x740/0xbb0 __do_softirq+0x183/0x5a4
The buggy address belongs to the object at ffff888485950880 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes inside of 64-byte region [ffff888485950880, ffff8884859508c0)
The buggy address belongs to the physical page: page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950 flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006 raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff888485950780: fa fb fb ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-livepatch-5.10.213-201.855Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade python-perfUpgrade kernel-tools-develUpgrade kernel-livepatch-5.15.152-100.162 | May 28, 2024 | Apr 4, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-livepatch-6.1.82-99.168Upgrade perf-debuginfoUpgrade kernelUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-staticUpgrade perfUpgrade kernel-libbpf-develUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfo | Feb 17, 2025 | Apr 4, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Apr 4, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Dec 5, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade dtb-mediatekUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-livepatchUpgrade dtb-armUpgrade dtb-caviumUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-obs-buildUpgrade kernel-azure-vdsoUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-azureUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-syms-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-rtUpgrade dtb-nvidiaUpgrade kernel-defaultUpgrade dtb-qcomUpgrade dlm-kmp-rtUpgrade dtb-sprdUpgrade kselftests-kmp-rtUpgrade kernel-azure-develUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-vdsoUpgrade dtb-rockchipUpgrade kernel-docsUpgrade kernel-default-vdsoUpgrade kernel-rt-develUpgrade reiserfs-kmp-azureUpgrade kernel-rtUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade dtb-socionextUpgrade dtb-marvellUpgrade dtb-apmUpgrade kernel-azure-optionalUpgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-azure-extraUpgrade reiserfs-kmp-defaultUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade ocfs2-kmp-rtUpgrade kernel-default-extraUpgrade dtb-renesasUpgrade kernel-rt_debugUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-macrosUpgrade kernel-rt_debug-develUpgrade dtb-broadcomUpgrade dtb-amdUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade kernel-devel-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-azureUpgrade dtb-xilinxUpgrade dtb-lgUpgrade dtb-alteraUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-debugUpgrade cluster-md-kmp-azureUpgrade dtb-amlogicUpgrade kernel-default-livepatchUpgrade kernel-symsUpgrade kernel-sourceUpgrade kernel-kvmsmallUpgrade kernel-develUpgrade dtb-amazonUpgrade kernel-zfcpdumpUpgrade dtb-allwinnerUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-default-base | Dec 5, 2025 | Dec 13, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.5.0-1023-awsUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-starfiveUpgrade linux-image-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-6.5.0-44-lowlatencyUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-nvidia-6.5Upgrade linux-image-aws-lts-22.04Upgrade linux-image-raspiUpgrade linux-image-genericUpgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-6.5.0-1026-oracle-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-gkeopUpgrade linux-image-6.5.0-1027-oemUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-azure-lts-22.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1066-azureUpgrade linux-image-6.5.0-1024-gcpUpgrade linux-image-azureUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-intelUpgrade linux-image-6.5.0-1023-nvidia-64kUpgrade linux-image-5.15.0-113-genericUpgrade linux-image-oem-22.04aUpgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-fdeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.5.0-1023-nvidiaUpgrade linux-image-5.15.0-112-genericUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-6.5.0-44-genericUpgrade linux-image-6.5.0-1026-oracleUpgrade linux-image-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-gke-5.15Upgrade linux-image-6.5.0-1020-raspiUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-6.5.0-1024-azure-fdeUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-virtualUpgrade linux-image-6.5.0-44-generic-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-6.5.0-1024-azureUpgrade linux-image-6.5.0-44-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-awsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-gkeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-20.04Upgrade linux-image-nvidia-64k-6.5Upgrade linux-image-6.5.0-1017-starfiveUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-110-lowlatency-64k | Jul 1, 2024 | Apr 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub