In the Linux kernel, the following vulnerability has been resolved:
mptcp: ensure snd_nxt is properly initialized on connect
Christoph reported a splat hinting at a corrupted snd_una:
WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Modules linked in: CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8 8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe <0f> 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9 RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4 RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000 R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000 FS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0 Call Trace: <TASK> __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline] mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline] __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615 mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767 process_one_work+0x1e0/0x560 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x3c7/0x640 kernel/workqueue.c:3416 kthread+0x121/0x170 kernel/kthread.c:388 ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 </TASK>
When fallback to TCP happens early on a client socket, snd_nxt is not yet initialized and any incoming ack will copy such value into snd_una. If the mptcp worker (dumbly) tries mptcp-level re-injection after such ack, that would unconditionally trigger a send buffer cleanup using 'bad' snd_una values.
We could easily disable re-injection for fallback sockets, but such dumb behavior already helped catching a few subtle issues and a very low to zero impact in practice.
Instead address the issue always initializing snd_nxt (and write_seq, for consistency) at connect time.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-debug-devel-matchedUpgrade kernel-headersUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-coreUpgrade kernel-modules-coreUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-64k-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debugUpgrade kernel-64k-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-64kUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-cross-headersUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-develUpgrade rtlaUpgrade kernel-tools-libsUpgrade kernel-debug-coreUpgrade kernel-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-kvmUpgrade libperfUpgrade kernel-develUpgrade kernel-rt-modulesUpgrade kernel-uki-virtUpgrade rvUpgrade kernel-rt-kvmUpgrade kernel-modules-extraUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-develUpgrade kernel-docUpgrade bpftoolUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-zfcpdumpUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-rt-devel | Aug 12, 2024 | May 30, 2024 |
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.218-206.860Upgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.160-104.158Upgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-devel | Jun 12, 2024 | May 30, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade kernelUpgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade bpftoolUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.1.91-99.172Upgrade kernel-develUpgrade perfUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfo | Feb 17, 2025 | May 30, 2024 |
| Debian | — | Upgrade linux | Jun 4, 2024 | May 30, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | May 30, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 12, 2024 | May 30, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-modules-extraUpgrade kernel-debuginfoUpgrade libperfUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-cross-headersUpgrade kernel-debugUpgrade kernel-debug-develUpgrade bpftool-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-coreUpgrade perf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-debuginfoUpgrade bpftoolUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libsUpgrade kernel-tools-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-debugUpgrade rvUpgrade libperf-debuginfoUpgrade kernel-rt-develUpgrade kernel-debug-uki-virtUpgrade kernel-debug-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade perfUpgrade kernel-develUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modules-coreUpgrade python3-perf-debuginfoUpgrade python3-perfUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-modules-core | Aug 22, 2024 | May 30, 2024 |
| Suse | — | Upgrade kernel-azureUpgrade dtb-socionextUpgrade dtb-broadcomUpgrade dtb-amazonUpgrade kernel-64kbUpgrade kselftests-kmp-azureUpgrade dtb-freescaleUpgrade kernel-docs-htmlUpgrade gfs2-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-rt-extraUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-caviumUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-default-livepatch-develUpgrade dtb-lgUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-develUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-rt-develUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-azureUpgrade dtb-armUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-defaultUpgrade kernel-docsUpgrade reiserfs-kmp-azureUpgrade kernel-develUpgrade kernel-debugUpgrade dtb-sprdUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-obs-qaUpgrade dtb-allwinnerUpgrade cluster-md-kmp-rtUpgrade kernel-devel-rtUpgrade dtb-qcomUpgrade dtb-exynosUpgrade dtb-apmUpgrade kernel-defaultUpgrade kernel-symsUpgrade dtb-mediatekUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade ocfs2-kmp-rtUpgrade dtb-alteraUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade dtb-nvidiaUpgrade kernel-macrosUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade dlm-kmp-rtUpgrade gfs2-kmp-rtUpgrade dtb-amdUpgrade dlm-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-rt_debugUpgrade kernel-source-azureUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-debug-devel | Aug 8, 2024 | May 30, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-1066-gcpUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1064-gkeUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-5.15.0-1070-azureUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-5.15.0-1062-nvidia-lowlatencyUpgrade linux-image-5.15.0-1070-azure-fdeUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-azureUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1010-oemUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-intelUpgrade linux-image-oem-20.04bUpgrade linux-image-nvidiaUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-genericUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-gcpUpgrade linux-image-gke-5.15Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-gkeUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-1060-ibmUpgrade linux-image-5.15.0-118-lowlatencyUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1065-oracleUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-5.15.0-1067-awsUpgrade linux-image-5.15.0-1062-intel-iotgUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-118-generic-64kUpgrade linux-image-azure-fdeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1050-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1062-nvidiaUpgrade linux-image-5.15.0-118-generic-lpaeUpgrade linux-image-5.15.0-118-lowlatency-64kUpgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-5.15.0-1064-kvmUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-5.15.0-1060-raspiUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-5.15.0-118-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibm-lts-24.04 | Aug 9, 2024 | May 30, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub