CVE-2024-26708 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: mptcp: really cope with fastopen race Fastopen and PM-trigger subflow shutdown can race, as reported by syzkaller. In my first attempt to close such race, I missed the fact that the subflow status can change again before the subflow_state_change callback is invoked. Address the issue additionally copying with all the states directly reachable from TCP_FIN_WAIT1.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f
https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2
https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f
https://lore.kernel.org/linux-cve-announce/2024040341-CVE-2024-26708-c98a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-26708
https://www.cve.org/CVERecord?id=CVE-2024-26708

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-04-03T14:55:11.054Z

Updated: 2024-08-02T00:14:12.552Z

Reserved: 2024-02-19T14:20:24.158Z

Link: CVE-2024-26708

Vulnrichment

Updated: 2024-05-23T19:01:21.844Z

NVD

Status : Awaiting Analysis

Published: 2024-04-03T15:15:53.390

Modified: 2024-04-03T17:24:18.150

Link: CVE-2024-26708

Redhat

Severity : Moderate

Publid Date: 2024-04-03T00:00:00Z

Links: CVE-2024-26708 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26708", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.158Z", "datePublished": "2024-04-03T14:55:11.054Z", "dateUpdated": "2024-08-02T00:14:12.552Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:21:14.499Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: really cope with fastopen race\n\nFastopen and PM-trigger subflow shutdown can race, as reported by\nsyzkaller.\n\nIn my first attempt to close such race, I missed the fact that\nthe subflow status can change again before the subflow_state_change\ncallback is invoked.\n\nAddress the issue additionally copying with all the states directly\nreachable from TCP_FIN_WAIT1."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.h"], "versions": [{"version": "1e777f39b4d7", "lessThan": "4bfe217e075d", "status": "affected", "versionType": "git"}, {"version": "1e777f39b4d7", "lessThan": "e158fb9679d1", "status": "affected", "versionType": "git"}, {"version": "1e777f39b4d7", "lessThan": "337cebbd850f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.h"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "custom"}, {"version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2"}, {"url": "https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f"}, {"url": "https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f"}], "title": "mptcp: really cope with fastopen race", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26708", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T18:54:23.010833Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:07.447Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.552Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26708", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.158Z", "datePublished": "2024-04-03T14:55:11.054Z", "dateUpdated": "2024-06-04T17:49:07.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:21:14.499Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: really cope with fastopen race\n\nFastopen and PM-trigger subflow shutdown can race, as reported by\nsyzkaller.\n\nIn my first attempt to close such race, I missed the fact that\nthe subflow status can change again before the subflow_state_change\ncallback is invoked.\n\nAddress the issue additionally copying with all the states directly\nreachable from TCP_FIN_WAIT1."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.h"], "versions": [{"version": "1e777f39b4d7", "lessThan": "4bfe217e075d", "status": "affected", "versionType": "git"}, {"version": "1e777f39b4d7", "lessThan": "e158fb9679d1", "status": "affected", "versionType": "git"}, {"version": "1e777f39b4d7", "lessThan": "337cebbd850f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.h"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "custom"}, {"version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2"}, {"url": "https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f"}, {"url": "https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f"}], "title": "mptcp: really cope with fastopen race", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26708", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-03T18:54:23.010833Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.844Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"bugzilla": {"description": "kernel: mptcp: really cope with fastopen race", "id": "2273166", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273166"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmptcp: really cope with fastopen race\nFastopen and PM-trigger subflow shutdown can race, as reported by\nsyzkaller.\nIn my first attempt to close such race, I missed the fact that\nthe subflow status can change again before the subflow_state_change\ncallback is invoked.\nAddress the issue additionally copying with all the states directly\nreachable from TCP_FIN_WAIT1.", "A vulnerability was found in the subflow_simultaneous_connect() function in the mptcp component in the Linux kernel, where not all possible subflow states are evaluated, leading to a potential race condition. This issue could lead to undefined network behavior."], "name": "CVE-2024-26708", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26708\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26708\nhttps://lore.kernel.org/linux-cve-announce/2024040341-CVE-2024-26708-c98a@gregkh/T"], "statement": "This vulnerability is rated as moderate because a race condition could be triggered and this could result in undefined network behavior. However, this undefined behavior would most likely only cause issues for a specific TCP connection/subflow.", "threat_severity": "Moderate", "upstream_fix": "kernel 6.6.18, kernel 6.7.6, kernel 6.8"}