PT-2024-9011 · Linux+9 · Linux Kernel+9
Christoph Paasch
·
Published
2024-05-30
·
Updated
2025-09-29
·
CVE-2024-36889
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.37
Description:
The issue is related to the mptcp component of the Linux kernel, where the
snd nxt variable is not properly initialized on connect, leading to potential corruption of snd una values. When fallback to TCP happens early on a client socket, snd nxt is not yet initialized, and any incoming ack will copy such value into snd una. If the mptcp worker tries mptcp-level re-injection after such ack, it would unconditionally trigger a send buffer cleanup using 'bad' snd una values. This could potentially cause issues, but the impact is considered very low to zero in practice.Recommendations:
To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider disabling re-injection for fallback sockets to minimize the risk of exploitation. However, this workaround is not necessary if the kernel is updated to the fixed version.
Exploit
Fix
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu