Vulnerability-Lookup

GHSA-X34G-XJXV-FC48

Vulnerability from github – Published: 2024-12-02 15:31 – Updated: 2025-11-04 00:32

Details

In the Linux kernel, the following vulnerability has been resolved:

mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs.

A racing recvmsg() spooling data received on an already established subflow would unconditionally call tcp_cleanup_rbuf() on all the current subflows, potentially hitting a divide by zero error on the newly created ones.

Explicitly check that the subflow is in a suitable state before invoking tcp_cleanup_rbuf().

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-53122"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-02T14:15:13Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: cope racing subflow creation in mptcp_rcv_space_adjust\n\nAdditional active subflows - i.e. created by the in kernel path\nmanager - are included into the subflow list before starting the\n3whs.\n\nA racing recvmsg() spooling data received on an already established\nsubflow would unconditionally call tcp_cleanup_rbuf() on all the\ncurrent subflows, potentially hitting a divide by zero error on\nthe newly created ones.\n\nExplicitly check that the subflow is in a suitable state before\ninvoking tcp_cleanup_rbuf().",
  "id": "GHSA-x34g-xjxv-fc48",
  "modified": "2025-11-04T00:32:09Z",
  "published": "2024-12-02T15:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53122"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0a9a182ea5c7bb0374e527130fd85024ace7279b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/24995851d58c4a205ad0ffa7b2f21e479a9c8527"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/aad6412c63baa39dd813e81f16a14d976b3de2e8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ce7356ae35943cc6494cc692e62d51a734062b7d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ff825ab2f455299c0c7287550915a8878e2a66e0"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-53122 (GCVE-0-2024-53122)

Vulnerability from cvelistv5 – Published: 2024-12-02 13:44 – Updated: 2026-08-05 11:43

Title

mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

Summary

In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs. A racing recvmsg() spooling data received on an already established subflow would unconditionally call tcp_cleanup_rbuf() on all the current subflows, potentially hitting a divide by zero error on the newly created ones. Explicitly check that the subflow is in a suitable state before invoking tcp_cleanup_rbuf().

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root Scorecard

References

6 references

URL	Tags
https://git.kernel.org/stable/c/0a9a182ea5c7bb037…
https://git.kernel.org/stable/c/24995851d58c4a205…
https://git.kernel.org/stable/c/ff825ab2f455299c0…
https://git.kernel.org/stable/c/aad6412c63baa39dd…
https://git.kernel.org/stable/c/ce7356ae35943cc64…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < 0a9a182ea5c7bb0374e527130fd85024ace7279b (git) Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < 24995851d58c4a205ad0ffa7b2f21e479a9c8527 (git) Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < ff825ab2f455299c0c7287550915a8878e2a66e0 (git) Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < aad6412c63baa39dd813e81f16a14d976b3de2e8 (git) Affected: c76c6956566f974bac2470bd72fc22fb923e04a1 , < ce7356ae35943cc6494cc692e62d51a734062b7d (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.119 , ≤ 6.1.* (semver) Unaffected: 6.6.63 , ≤ 6.6.* (semver) Unaffected: 6.11.10 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:29:28.992Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a9a182ea5c7bb0374e527130fd85024ace7279b",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            },
            {
              "lessThan": "24995851d58c4a205ad0ffa7b2f21e479a9c8527",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            },
            {
              "lessThan": "ff825ab2f455299c0c7287550915a8878e2a66e0",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            },
            {
              "lessThan": "aad6412c63baa39dd813e81f16a14d976b3de2e8",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            },
            {
              "lessThan": "ce7356ae35943cc6494cc692e62d51a734062b7d",
              "status": "affected",
              "version": "c76c6956566f974bac2470bd72fc22fb923e04a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.119",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.63",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.10",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: cope racing subflow creation in mptcp_rcv_space_adjust\n\nAdditional active subflows - i.e. created by the in kernel path\nmanager - are included into the subflow list before starting the\n3whs.\n\nA racing recvmsg() spooling data received on an already established\nsubflow would unconditionally call tcp_cleanup_rbuf() on all the\ncurrent subflows, potentially hitting a divide by zero error on\nthe newly created ones.\n\nExplicitly check that the subflow is in a suitable state before\ninvoking tcp_cleanup_rbuf()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is reached from `mptcp_recvmsg()` processing data delivered by a remote MPTCP peer, and the racing subflow creation is triggered by remote MPTCP signalling (ADD_ADDR handling in the in-kernel path manager) over the TCP/IP stack. No local access is needed \u2014 any host terminating MPTCP connections is exposed to its peers.\nAC:L - The attacker controls both sides of the race: it drives the bulk data flow that forces `mptcp_rcv_space_adjust()` into the subflow loop and drives new-subflow creation via ADD_ADDR/RM_ADDR announcements (which can point at a blackholed address to widen the non-established window), and can retry the sequence indefinitely at no cost.\nPR:N - MPTCP data and ADD_ADDR option processing carry no authentication or authorization check, so an unauthenticated remote peer on an established MPTCP connection reaches the code. Even in the purely local scenario, the MPTCP path-manager netlink family uses GENL_UNS_ADMIN_PERM and is therefore usable by an unprivileged user inside `unshare -Urn`.\nUI:N - No victim action is required \u2014 an MPTCP-enabled server accepting connections, or a client already exchanging data, hits the path automatically as the kernel path manager creates additional subflows.\nS:U - The crash occurs in the kernel\u0027s own TCP/MPTCP receive path and affects only the kernel\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is an arithmetic exception on a zero `icsk_ack.rcv_mss`; no memory is read out of bounds and no kernel data is copied to the attacker or to userspace.\nI:N - Nothing is written out of bounds or corrupted \u2014 the faulting instruction traps before any state modification, so there is no write primitive or control-flow influence.\nA:H - The divide-by-zero raises a #DE in kernel context, producing an oops that kills the receiving task while it holds the MPTCP socket lock and the subflow\u0027s fast lock, permanently wedging the socket; on systems with `panic_on_oops` set it is an immediate full kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:53.003Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a9a182ea5c7bb0374e527130fd85024ace7279b"
        },
        {
          "url": "https://git.kernel.org/stable/c/24995851d58c4a205ad0ffa7b2f21e479a9c8527"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff825ab2f455299c0c7287550915a8878e2a66e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/aad6412c63baa39dd813e81f16a14d976b3de2e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce7356ae35943cc6494cc692e62d51a734062b7d"
        }
      ],
      "title": "mptcp: cope racing subflow creation in mptcp_rcv_space_adjust",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53122",
    "datePublished": "2024-12-02T13:44:52.678Z",
    "dateReserved": "2024-11-19T17:17:24.994Z",
    "dateUpdated": "2026-08-05T11:43:53.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-X34G-XJXV-FC48

CVE-2024-53122 (GCVE-0-2024-53122)

Tags

Sightings

Nomenclature

Related by attack behaviour