CVE-2024-36889: mptcp: ensure snd_nxt is properly initialized on connect
First published: Thu May 30 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_nxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snd_una: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Modules linked in: CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8 8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe <0f> 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9 RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4 RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000 R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000 FS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0 Call Trace: <TASK> __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline] mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline] __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615 mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767 process_one_work+0x1e0/0x560 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x3c7/0x640 kernel/workqueue.c:3416 kthread+0x121/0x170 kernel/kthread.c:388 ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 </TASK> When fallback to TCP happens early on a client socket, snd_nxt is not yet initialized and any incoming ack will copy such value into snd_una. If the mptcp worker (dumbly) tries mptcp-level re-injection after such ack, that would unconditionally trigger a send buffer cleanup using 'bad' snd_una values. We could easily disable re-injection for fallback sockets, but such dumb behavior already helped catching a few subtle issues and a very low to zero impact in practice. Instead address the issue always initializing snd_nxt (and write_seq, for consistency) at connect time.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <5.10.218 | 5.10.218 |
| redhat/kernel | <5.15.159 | 5.15.159 |
| redhat/kernel | <6.1.91 | 6.1.91 |
| redhat/kernel | <6.6.31 | 6.6.31 |
| redhat/kernel | <6.8.10 | 6.8.10 |
| redhat/kernel | <6.9 | 6.9 |
| IBM Security Verify Governance - Identity Manager | <=ISVG 10.0.2 | |
| IBM Security Verify Governance, Identity Manager Software Stack | <=ISVG 10.0.2 | |
| IBM Security Verify Governance, Identity Manager Virtual Appliance | <=ISVG 10.0.2 | |
| IBM Security Verify Governance Identity Manager Container | <=ISVG 10.0.2 | |
| debian/linux | 5.10.223-1 5.10.234-1 6.1.129-1 6.1.128-1 6.12.21-1 6.12.22-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/39ca83ed73db9edcc6d70c0dc7a73085a4725012
- https://git.kernel.org/stable/c/592f69b41766d366dbb8ff4ef5a67c4396527bbe
- https://git.kernel.org/stable/c/99951b62bf20cec9247f633a3bea898338b9e5b4
- https://git.kernel.org/stable/c/aa0c07c1f20e05b30019bff083ec43665536f06f
- https://git.kernel.org/stable/c/dc941fec0719d0471a5902424d6b2a17df233193
- https://git.kernel.org/stable/c/fb7a0d334894206ae35f023a82cad5a290fd7386
- https://launchpad.net/bugs/cve/CVE-2024-36889
- https://access.redhat.com/security/cve/CVE-2024-36889
- https://lore.kernel.org/linux-cve-announce/2024053033-CVE-2024-36889-222d@gregkh/T
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2284572
- https://access.redhat.com/errata/RHSA-2024:5102
- https://access.redhat.com/errata/RHSA-2024:5101
- https://access.redhat.com/errata/RHSA-2024:6998
- https://access.redhat.com/errata/RHSA-2024:8162
- https://access.redhat.com/errata/RHSA-2024:8614
- https://access.redhat.com/errata/RHSA-2024:8613
- https://access.redhat.com/errata/RHSA-2024:10262
- https://bugzilla.redhat.com/show_bug.cgi?id=2284571
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36889
- https://nvd.nist.gov/vuln/detail/CVE-2024-36889
- https://security-tracker.debian.org/tracker/CVE-2024-36889
- https://ubuntu.com/security/CVE-2024-36889
- https://git.kernel.org/linus/fb7a0d334894206ae35f023a82cad5a290fd7386
- https://www.ibm.com/support/pages/node/7230443 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-36889?
CVE-2024-36889 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-36889?
To fix CVE-2024-36889, update your Linux kernel to the versions 5.10.218, 5.15.159, 6.1.91, 6.6.31, 6.8.10, or 6.9 as appropriate.
Which versions of the Linux kernel are affected by CVE-2024-36889?
CVE-2024-36889 affects various versions of the Linux kernel prior to the specified patched versions.
What impact does CVE-2024-36889 have on Linux systems?
CVE-2024-36889 can lead to issues related to improper initialization of the snd_nxt variable on connection, potentially causing system errors.
Who reported the CVE-2024-36889 vulnerability?
The CVE-2024-36889 vulnerability was reported by Christoph.
- agent/title
- agent/type
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- collector/launchpad-cve
- source/Launchpad
- agent/remedy
- agent/first-publish-date
- agent/author
- collector/nvd-api
- source/NVD
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-36889
- agent/software-canonical-lookup
- collector/nvd-cve
- collector/mitre-cve
- source/MITRE
- agent/trending
- collector/usn-cve
- source/Ubuntu
- collector/security-tracker-debian
- source/Debian
- agent/last-modified-date
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/ibm-support
- source/IBM
- package-manager/redhat
- package-manager/debian
- vendor/ibm
- canonical/ibm security verify governance - identity manager
- version/ibm security verify governance - identity manager/isvg 10.0.2
- canonical/ibm security verify governance, identity manager software stack
- version/ibm security verify governance, identity manager software stack/isvg 10.0.2
- canonical/ibm security verify governance, identity manager virtual appliance
- version/ibm security verify governance, identity manager virtual appliance/isvg 10.0.2
- canonical/ibm security verify governance identity manager container
- version/ibm security verify governance identity manager container/isvg 10.0.2