NVD Vulnerability Detail

CVE-2024-45009

Summary	In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR. A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR.
Publication Date	Sept. 12, 2024, 1:15 a.m.
Registration Date	Sept. 12, 2024, 5 a.m.
Last Update	Sept. 14, 2024, 1:36 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://git.kernel.org/stable/c/85b866e4c4e63a1d7afb58f1e24273caad03d0b7	Patch
2	https://git.kernel.org/stable/c/d20bf2c96d7ffd171299b32f562f70e5bf5dc608	Patch
3	https://git.kernel.org/stable/c/2060f1efab370b496c4903b840844ecaff324c3c	Patch
4	https://git.kernel.org/stable/c/1c1f721375989579e46741f59523e39ec9b2a9bd	Patch
5	https://git.kernel.org/stable/c/35b31f5549ede4070566b949781e83495906b43d	Patch

Common Vulnerabilities List

JVN Vulnerability Information

Linux の Linux Kernel における脆弱性

Title	Linux の Linux Kernel における脆弱性
Summary	Linux の Linux Kernel には、不特定の脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 20, 2024, midnight
Registration Date	Sept. 18, 2024, 10:46 a.m.
Last Update	Sept. 18, 2024, 10:46 a.m.

Affected System

Linux

Linux Kernel 5.10 以上 5.15.167 未満

Linux Kernel 5.16 以上 6.1.107 未満

Linux Kernel 6.11

Linux Kernel 6.2 以上 6.6.48 未満

Linux Kernel 6.7 以上 6.10.7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2024-45009	https://www.cve.org/CVERecord?id=CVE-2024-45009
National Vulnerability Database (NVD)
2	CVE-2024-45009	https://nvd.nist.gov/vuln/detail/CVE-2024-45009

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/scap/cwe.html

ベンダー情報

No	Name	URL
Kernel.org git repositories
1	mptcp: pm: only decrement add_addr_accepted for MPJ req (1c1f721)	https://git.kernel.org/stable/c/1c1f721375989579e46741f59523e39ec9b2a9bd
2	mptcp: pm: only decrement add_addr_accepted for MPJ req (2060f1e)	https://git.kernel.org/stable/c/2060f1efab370b496c4903b840844ecaff324c3c
3	mptcp: pm: only decrement add_addr_accepted for MPJ req (35b31f5)	https://git.kernel.org/stable/c/35b31f5549ede4070566b949781e83495906b43d
4	mptcp: pm: only decrement add_addr_accepted for MPJ req (85b866e)	https://git.kernel.org/stable/c/85b866e4c4e63a1d7afb58f1e24273caad03d0b7
5	mptcp: pm: only decrement add_addr_accepted for MPJ req (d20bf2c)	https://git.kernel.org/stable/c/d20bf2c96d7ffd171299b32f562f70e5bf5dc608
Linux Kernel
6	Linux Kernel Archives	https://www.kernel.org

Change Log

No	Changed Details	Date of change
1	[2024年09月17日] 掲載	Sept. 17, 2024, 5:28 p.m.