{ "threat_severity" : "Moderate", "public_date" : "2024-05-30T00:00:00Z", "bugzilla" : { "description" : "kernel: mptcp: ensure snd_nxt is properly initialized on connect", "id" : "2284571", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2284571" }, "cvss3" : { "cvss3_base_score" : "5.5", "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status" : "verified" }, "cwe" : "CWE-665", "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nmptcp: ensure snd_nxt is properly initialized on connect\nChristoph reported a splat hinting at a corrupted snd_una:\nWARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\nModules linked in:\nCPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\nWorkqueue: events mptcp_worker\nRIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\nCode: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8\n8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe\n<0f> 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9\nRSP: 0018:ffffc9000013fd48 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4\nRDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001\nRBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000\nR13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000\nFS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0\nCall Trace:\n\n__mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline]\nmptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline]\n__mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615\nmptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767\nprocess_one_work+0x1e0/0x560 kernel/workqueue.c:3254\nprocess_scheduled_works kernel/workqueue.c:3335 [inline]\nworker_thread+0x3c7/0x640 kernel/workqueue.c:3416\nkthread+0x121/0x170 kernel/kthread.c:388\nret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243\n\nWhen fallback to TCP happens early on a client socket, snd_nxt\nis not yet initialized and any incoming ack will copy such value\ninto snd_una. If the mptcp worker (dumbly) tries mptcp-level\nre-injection after such ack, that would unconditionally trigger a send\nbuffer cleanup using 'bad' snd_una values.\nWe could easily disable re-injection for fallback sockets, but such\ndumb behavior already helped catching a few subtle issues and a very\nlow to zero impact in practice.\nInstead address the issue always initializing snd_nxt (and write_seq,\nfor consistency) at connect time." ], "affected_release" : [ { "product_name" : "Red Hat Enterprise Linux 8", "release_date" : "2024-08-08T00:00:00Z", "advisory" : "RHSA-2024:5102", "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv", "package" : "kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10" }, { "product_name" : "Red Hat Enterprise Linux 8", "release_date" : "2024-08-08T00:00:00Z", "advisory" : "RHSA-2024:5101", "cpe" : "cpe:/o:redhat:enterprise_linux:8", "package" : "kernel-0:4.18.0-553.16.1.el8_10" }, { "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date" : "2024-09-24T00:00:00Z", "advisory" : "RHSA-2024:6998", "cpe" : "cpe:/o:redhat:rhel_aus:8.6", "package" : "kernel-0:4.18.0-372.124.1.el8_6" }, { "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date" : "2024-09-24T00:00:00Z", "advisory" : "RHSA-2024:6998", "cpe" : "cpe:/o:redhat:rhel_tus:8.6", "package" : "kernel-0:4.18.0-372.124.1.el8_6" }, { "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date" : "2024-09-24T00:00:00Z", "advisory" : "RHSA-2024:6998", "cpe" : "cpe:/o:redhat:rhel_e4s:8.6", "package" : "kernel-0:4.18.0-372.124.1.el8_6" }, { "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date" : "2024-11-26T00:00:00Z", "advisory" : "RHSA-2024:10262", "cpe" : "cpe:/o:redhat:rhel_eus:8.8", "package" : "kernel-0:4.18.0-477.81.1.el8_8" }, { "product_name" : "Red Hat Enterprise Linux 9", "release_date" : "2024-10-16T00:00:00Z", "advisory" : "RHSA-2024:8162", "cpe" : "cpe:/a:redhat:enterprise_linux:9", "package" : "kernel-0:5.14.0-427.40.1.el9_4" }, { "product_name" : "Red Hat Enterprise Linux 9", "release_date" : "2024-10-16T00:00:00Z", "advisory" : "RHSA-2024:8162", "cpe" : "cpe:/o:redhat:enterprise_linux:9", "package" : "kernel-0:5.14.0-427.40.1.el9_4" }, { "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date" : "2024-10-30T00:00:00Z", "advisory" : "RHSA-2024:8613", "cpe" : "cpe:/a:redhat:rhel_eus:9.2", "package" : "kernel-0:5.14.0-284.90.1.el9_2" }, { "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date" : "2024-10-30T00:00:00Z", "advisory" : "RHSA-2024:8614", "cpe" : "cpe:/a:redhat:rhel_eus:9.2::nfv", "package" : "kernel-rt-0:5.14.0-284.90.1.rt14.375.el9_2" } ], "package_state" : [ { "product_name" : "Red Hat Enterprise Linux 6", "fix_state" : "Not affected", "package_name" : "kernel", "cpe" : "cpe:/o:redhat:enterprise_linux:6" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Not affected", "package_name" : "kernel", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Not affected", "package_name" : "kernel-rt", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Affected", "package_name" : "kernel-rt", "cpe" : "cpe:/o:redhat:enterprise_linux:9" } ], "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-36889\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36889\nhttps://lore.kernel.org/linux-cve-announce/2024053033-CVE-2024-36889-222d@gregkh/T" ], "name" : "CVE-2024-36889", "csaw" : false }