In the Linux kernel, the following vulnerability has been resolved:
tipc: fix kernel warning when sending SYN message
When sending a SYN message, this kernel stack trace is observed:
... [ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550 ... [ 13.398494] Call Trace: [ 13.398630] <TASK> [ 13.398630] ? __alloc_skb+0xed/0x1a0 [ 13.398630] tipc_msg_build+0x12c/0x670 [tipc] [ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290 [ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc] [ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __local_bh_enable_ip+0x37/0x80 [ 13.398630] tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __sys_connect+0x9f/0xd0 [ 13.398630] __sys_connect+0x9f/0xd0 [ 13.398630] ? preempt_count_add+0x4d/0xa0 [ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50 [ 13.398630] __x64_sys_connect+0x16/0x20 [ 13.398630] do_syscall_64+0x42/0x90 [ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd
It is because commit a41dad905e5a ("iov_iter: saner checks for attempt to copy to/from iterator") has introduced sanity check for copying from/to iov iterator. Lacking of copy direction from the iterator viewpoint would lead to kernel stack trace like above.
This commit fixes this issue by initializing the iov iterator with the correct copy direction when sending SYN or ACK without data.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdumpUpgrade perfUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-modules-extraUpgrade kernel-headersUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rtUpgrade kernel-docUpgrade kernel-rt-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debugUpgrade kernel-debug-develUpgrade kernel-tools-libsUpgrade kernel-rt-debug-develUpgrade bpftoolUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernelUpgrade kernel-tools-libs-develUpgrade kernel-cross-headersUpgrade kernel-rt-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-rt-debug-coreUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-core | Jul 3, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 3, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-modulesUpgrade perfUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-rt-debug-develUpgrade kernel-rt-debuginfoUpgrade python3-perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade perf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-develUpgrade bpftoolUpgrade kernel-rt-kvmUpgrade kernel-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-debugUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-modules-extra | Jul 16, 2024 | May 21, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub