CVE - CVE-2024-45009

CVE-ID
CVE-2024-45009	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR. A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/1c1f721375989579e46741f59523e39ec9b2a9bd URL:https://git.kernel.org/stable/c/1c1f721375989579e46741f59523e39ec9b2a9bd MISC:https://git.kernel.org/stable/c/2060f1efab370b496c4903b840844ecaff324c3c URL:https://git.kernel.org/stable/c/2060f1efab370b496c4903b840844ecaff324c3c MISC:https://git.kernel.org/stable/c/35b31f5549ede4070566b949781e83495906b43d URL:https://git.kernel.org/stable/c/35b31f5549ede4070566b949781e83495906b43d MISC:https://git.kernel.org/stable/c/85b866e4c4e63a1d7afb58f1e24273caad03d0b7 URL:https://git.kernel.org/stable/c/85b866e4c4e63a1d7afb58f1e24273caad03d0b7 MISC:https://git.kernel.org/stable/c/d20bf2c96d7ffd171299b32f562f70e5bf5dc608 URL:https://git.kernel.org/stable/c/d20bf2c96d7ffd171299b32f562f70e5bf5dc608
Assigning CNA
kernel.org
Date Record Created
20240821	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240821)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)