CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: only mark 'subflow' endp as available
Adding the following warning ...
WARNONONCE(msk->pm.localaddrused == 0)
... before decrementing the localaddrused counter helped to find a bug when running the "remove single address" subtest from the mptcpjoin.sh selftests.
Removing a 'signal' endpoint will trigger the removal of all subflows linked to this endpoint via mptcppmnlrmaddrorsubflow() with rmtype == MPTCPMIBRMSUBFLOW. This will decrement the localaddrused counter, which is wrong in this case because this counter is linked to 'subflow' endpoints, and here it is a 'signal' endpoint that is being removed.
Now, the counter is decremented, only if the ID is being used outside of mptcppmnlrmaddrorsubflow(), only for 'subflow' endpoints, and if the ID is not 0 -- localaddrused is not taking into account these ones. This marking of the ID as being available, and the decrement is done no matter if a subflow using this ID is currently available, because the subflow could have been closed before.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45010?
CVE-2024-45010 is categorized as a high severity vulnerability in the Linux kernel.
How do I fix CVE-2024-45010?
To fix CVE-2024-45010, update to the patched versions of the Linux kernel provided in the release notes.
Which Linux kernel versions are affected by CVE-2024-45010?
CVE-2024-45010 affects multiple versions of the Linux kernel, specifically those before the patched versions 5.10.223-1, 5.10.226-1, 6.1.119-1, and others listed.
What is the nature of the vulnerability CVE-2024-45010?
CVE-2024-45010 involves a potential bug in the MPTCP (Multipath TCP) implementation related to the local address used counter.
When was CVE-2024-45010 resolved?
CVE-2024-45010 was resolved recently with the addition of a warning in the Linux kernel code.