In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up und…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the unlock and the read, leading to UAF. The race window is narrow. It was reproduced only with a locally constructed stress test that repeatedly overlaps an MP_JOIN SYN with a MPTCP_PM_CMD_SUB…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/31ce5af66891f79998fb2e8b8df08e3c98fd72e3
- https://git.kernel.org/stable/c/40dde4b5d98279471a70e5c8bb713182738c00d9
- https://git.kernel.org/stable/c/8ce48d2879aafc0e7a6f8bfc3613c0ba979ec6f5
- https://git.kernel.org/stable/c/9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9
- https://git.kernel.org/stable/c/d2c3760b45f2f481a4dd4c5adef4a29dfabd948f
- https://git.kernel.org/stable/c/d64f6c02495f3fad674038cfa7ec049671b59e7b
Timeline
- nvd_ingest NVD