Critical Vulnerability in Linux Package: BPF Access to MPTCP Subflow Socket
Summary
DEBIAN-CVE-2024-35894: In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent BPF accessing lowat from a subflow socket. Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential functionalities such as process management, memory management, and device control. It supports various networking protocols, including MultiPath TCP (MPTCP), which enhances TCP by allowing multiple paths for data transmission. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the BPF (Berkeley Packet Filter) allowing unauthorized access to MPTCP-level operations from a TCP subflow context.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where BPF can access MPTCP-level proto_ops from a TCP subflow scope. This issue can lead to unexpected behavior and potential exploitation, as it allows subflow sockets to manipulate MPTCP settings improperly. The vulnerability was reported by Alexei, highlighting a warning during execution that indicates a flaw in the subflow data handling process. The root cause is a lack of proper checks in the BPF implementation, which could lead to security risks if exploited.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with the vulnerability.
Conclusion
The identified vulnerability in the Linux kernel regarding BPF access to MPTCP subflow sockets poses significant security risks. Users are strongly advised to update their systems to the patched version to ensure protection against potential exploitation. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows BPF to access MPTCP-level proto_ops from a TCP subflow, potentially leading to unauthorized manipulation of MPTCP settings.
The vulnerability affects Linux kernel versions in Debian 13 and 14 prior to the patched version 6.8.9-1.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your manifest file.
While no specific workarounds are available, it is crucial to plan for an update as soon as possible to mitigate risks.
Detailed information can be found in the Debian CVE database or through security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
