vulnerability
Ubuntu: (Multiple Advisories) (CVE-2024-41007): Linux kernel vulnerabilities
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
2 | (AV:L/AC:L/Au:S/C:N/I:N/A:P) | Jul 15, 2024 | Sep 13, 2024 | Jan 30, 2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
tcp: avoid too many retransmit packets
If a TCP socket is using TCP_USER_TIMEOUT, and the other peer
retracted its window to zero, tcp_retransmit_timer() can
retransmit a packet every two jiffies (2 ms for HZ=1000),
for about 4 minutes after TCP_USER_TIMEOUT has 'expired'.
The fix is to make sure tcp_rtx_probe0_timed_out() takes
icsk->icsk_user_timeout into account.
Before blamed commit, the socket would not timeout after
icsk->icsk_user_timeout, but would use standard exponential
backoff for the retransmits.
Also worth noting that before commit e89688e3e978 ("net: tcp:
fix unexcepted socket die when snd_wnd is 0"), the issue
would last 2 minutes instead of 4.
Solution(s)
References
- CVE-2024-41007
- https://attackerkb.com/topics/CVE-2024-41007
- UBUNTU-USN-7003-1
- UBUNTU-USN-7003-2
- UBUNTU-USN-7003-3
- UBUNTU-USN-7003-4
- UBUNTU-USN-7003-5
- UBUNTU-USN-7006-1
- UBUNTU-USN-7007-1
- UBUNTU-USN-7007-2
- UBUNTU-USN-7007-3
- UBUNTU-USN-7009-1
- UBUNTU-USN-7009-2
- UBUNTU-USN-7019-1
- UBUNTU-USN-7089-1
- UBUNTU-USN-7089-2
- UBUNTU-USN-7089-3
- UBUNTU-USN-7089-4
- UBUNTU-USN-7089-5
- UBUNTU-USN-7089-6
- UBUNTU-USN-7089-7
- UBUNTU-USN-7090-1
- UBUNTU-USN-7095-1
- UBUNTU-USN-7156-1

Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.