CVE-2024-46711

Summary

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: fix ID 0 endp usage after multiple re-creations

'local_addr_used' and 'add_addr_accepted' are decremented for addresses not related to the initial subflow (ID0), because the source and destination addresses of the initial subflows are known from the beginning: they don't count as "additional local address being used" or "ADD_ADDR being accepted".

It is then required not to increment them when the entrypoint used by the initial subflow is removed and re-added during a connection. Without this modification, this entrypoint cannot be removed and re-added more than once.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux3ad14f54bd7448384458e69f0183843f683ecce8 < c9c744666f7308a4daba520191e29d395260bcfeaffected
LinuxLinux3ad14f54bd7448384458e69f0183843f683ecce8 < 53e2173172d26c0617b29dd83618b71664bed1fbaffected
LinuxLinux3ad14f54bd7448384458e69f0183843f683ecce8 < 119806ae4e46cf239db8e6ad92bc2fd3daae86dcaffected
LinuxLinux3ad14f54bd7448384458e69f0183843f683ecce8 < 9366922adc6a71378ca01f898c41be295309f044affected
LinuxLinux6.0affected
LinuxLinux0 < 6.0unaffected
LinuxLinux6.1.109 <= 6.1.*unaffected
LinuxLinux6.6.49 <= 6.6.*unaffected
LinuxLinux6.10.8 <= 6.10.*unaffected
LinuxLinux6.11 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References