Описание
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()
and/or mptcp_pm_nl_is_backup()
Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()
which is not RCU ready.
list_splice_init_rcu() can not be called here while holding pernet->lock
spinlock.
Many thanks to Eulgyu Kim for providing a repro and testing our patches.
A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. A race condition exists in the mptcp_pm_nl_flush_addrs_doit() function due to improper synchronization when handling network addresses. This flaw could allow a local attacker to trigger system crashes, leading to a Denial of Service (DoS).
Отчет
A moderate-severity race condition flaw was found in the Linux kernel's Multipath TCP (MPTCP) path manager netlink implementation. The list_splice_init() call in mptcp_pm_nl_flush_addrs_doit() is not RCU-safe, so a local user able to issue MPTCP netlink address-flush operations can race concurrent readers such as mptcp_pm_nl_get_local_id() or mptcp_pm_nl_is_backup(), leading to list corruption or use-after-free and a kernel crash, resulting in denial of service. Red Hat rates this flaw Moderate because exploitation requires local access, privileges to perform MPTCP netlink operations, and high race complexity, with impact limited to availability (CVSS 3.1: 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H). This differs from the upstream CVE record, which scores 7.8 assuming low attack complexity and confidentiality and integrity impact; Red Hat's assessment finds the practical impact to be denial of service only. The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, 8, and 9 (kernel and kernel-rt), so those products are not affected. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; the fix is currently deferred for these products, and the residual risk remains local denial of service by an attacker who already has the required local privileges.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.6 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches.
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches.
In the Linux kernel, the following vulnerability has been resolved: m ...
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches.
EPSS
5.6 Medium
CVSS3