mptcp: Fix soft lookup in subflow_error_report() in Kernel
Summary
GSD-2021-1001064: mptcp: fix soft lookup in subflow_error_report(). Affects Kernel versions >= 15cc10453398c22f78f6c2b897119ecce5e5dd89, < 27ef25c72373222aaa5fe7b5cd890ae9cfb89a8d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionalities and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The vulnerability in question affects the Kernel's implementation of the Multipath TCP (MPTCP) protocol. MPTCP is an extension to TCP that allows for the simultaneous use of multiple network paths, improving performance and resilience. However, a flaw in the subflow_error_report() function can lead to a soft lookup issue, potentially compromising the integrity and reliability of MPTCP connections.
Vulnerability Detail
The vulnerability arises from a soft lookup problem in the subflow_error_report() function of the MPTCP implementation in the Kernel. This flaw can be exploited by an attacker to manipulate MPTCP connections, leading to potential denial-of-service attacks, data corruption, or unauthorized access to sensitive information. The vulnerability was introduced in Kernel version v5.12 and has been fixed in version v5.12.13 by commit 27ef25c72373222aaa5fe7b5cd890ae9cfb89a8d. It is crucial for users to update their Kernel to the patched version to mitigate the risk associated with this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the Kernel's MPTCP implementation can have severe consequences, including denial-of-service attacks, data corruption, and unauthorized access. It is crucial for users to update their Linux Kernel to version v5.12.13 or later to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially lead to denial-of-service attacks, data corruption, or unauthorized access to sensitive information through manipulation of MPTCP connections.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time alerts for open-source vulnerabilities, including this one.
No specific workaround has been provided for this vulnerability. It is recommended to update the Linux Kernel to the patched version as soon as possible.
No, only Linux Kernel versions from v5.12 to v5.12.12 are affected. The vulnerability has been fixed in version v5.12.13 and later.
The details of the vulnerability discovery and reporting are not provided in the available information.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
