Vulnerability in mptcp package: Clear 'kern' flag from fallback sockets
Summary
GSD-2021-1002701: mptcp: clear 'kern' flag from fallback sockets. Affects Kernel versions >= cf7da0d66cc1a2a19fc5930bb746ffbb2d4cd1be, < 451f1eded7f56e93aaf52eb547ba97742d9c0e97. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mptcp package is a component of the Linux Kernel ecosystem. It provides support for Multipath TCP (MPTCP), a protocol extension that allows a single TCP connection to use multiple paths simultaneously. MPTCP enables improved performance, fault tolerance, and load balancing in network communications. However, a vulnerability has been discovered in the package that involves the 'kern' flag not being cleared from fallback sockets.
Vulnerability Detail
The vulnerability in the mptcp package arises from the failure to clear the 'kern' flag from fallback sockets. This flag is used to indicate that a socket is a fallback socket, which is created when a subflow fails during MPTCP connection establishment. By not clearing this flag, an attacker may be able to manipulate the behavior of the fallback socket, potentially leading to unauthorized access, data leakage, or denial of service. The impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the mptcp package in the Linux Kernel is vulnerable to a flaw where the 'kern' flag is not cleared from fallback sockets. This vulnerability can potentially lead to unauthorized access, data leakage, or denial of service. It is recommended to update the Kernel to version v5.10.88 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The mptcp package is a component of the Linux Kernel ecosystem that provides support for Multipath TCP (MPTCP), enabling a single TCP connection to use multiple paths simultaneously.
The 'kern' flag in the mptcp package is used to indicate that a socket is a fallback socket, which is created when a subflow fails during MPTCP connection establishment.
The potential consequences of this vulnerability include unauthorized access, data leakage, or denial of service, as the behavior of the fallback socket can be manipulated by an attacker.
No, the impact and attack plausibility of this vulnerability have not yet been proven.
To fix this vulnerability, update the Linux Kernel to version v5.10.88 or later, which ensures that the 'kern' flag is properly cleared from fallback sockets.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
