CVE-2024-46711: mptcp: pm: fix ID 0 endp usage after multiple re-creations
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: fix ID 0 endp usage after multiple re-creations
'localaddrused' and 'addaddraccepted' are decremented for addresses not related to the initial subflow (ID0), because the source and destination addresses of the initial subflows are known from the beginning: they don't count as "additional local address being used" or "ADDADDR being accepted".
It is then required not to increment them when the entrypoint used by the initial subflow is removed and re-added during a connection. Without this modification, this entrypoint cannot be removed and re-added more than once.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46711?
CVE-2024-46711 is classified as a high severity vulnerability in the Linux kernel.
How do I fix CVE-2024-46711?
To fix CVE-2024-46711, update your Linux kernel to a version that has addressed this vulnerability, such as 5.10.223-1 or above.
Which Linux kernel versions are affected by CVE-2024-46711?
CVE-2024-46711 affects Linux kernel versions from 6.0 to 6.1.109, 6.2 to 6.6.49, and specific 6.11 release candidates.
What components are impacted by CVE-2024-46711?
CVE-2024-46711 affects the MultiPath TCP (mptcp) implementation in the Linux kernel.
Is CVE-2024-46711 a remote code execution vulnerability?
CVE-2024-46711 does not specifically indicate remote code execution but addresses resource management issues that could lead to stability concerns.