mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb
Summary
GSD-2022-1001513: mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb. Affects Kernel versions >= f70cad1085d1e01d3ec73c1078405f906237feee, < 752add6f5ce5305e55d8bda4ac8d69be3a09f14d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mptcp package is a component of the Linux Kernel ecosystem. It provides support for Multipath TCP (MPTCP), which allows for the simultaneous use of multiple network paths in a single TCP connection. MPTCP enhances reliability and performance by utilizing multiple network interfaces. However, a vulnerability has been identified in the package that can lead to a crash. This vulnerability affects versions of the Linux Kernel from v5.16 to v5.16.18.
Vulnerability Detail
The vulnerability in the mptcp package arises from the improper initialization of tcp_tsorted_anchor before releasing skb. This flaw can result in a crash, potentially leading to a denial-of-service (DoS) condition. An attacker may be able to exploit this vulnerability to disrupt network connectivity or cause system instability. The vulnerability was introduced in version v5.16 of the Linux Kernel and has been fixed in version v5.16.19.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the Linux Kernel to the recommended version.
Conclusion
The mptcp package in the Linux Kernel is vulnerable to a crash due to improper initialization of tcp_tsorted_anchor before releasing skb. This vulnerability can lead to a denial-of-service (DoS) condition. To mitigate this risk, it is crucial to update the Linux Kernel to version v5.16.19 or later. Regularly updating the kernel is essential to ensure the application of the latest security fixes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in a crash, potentially leading to a denial-of-service (DoS) condition. It may allow an attacker to disrupt network connectivity or cause system instability.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit for this vulnerability. However, it is crucial to apply the fix promptly to mitigate any potential risks.
Unfortunately, there is no known temporary measure or workaround for this vulnerability. It is highly recommended to update the Linux Kernel to the fixed version as soon as possible.
For more information about this vulnerability, you can refer to the vulnerability details in the GSD database at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1001xxx/GSD-2022-1001513.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
