In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: fix TFO max_qlen accounting across reuseport migration<\/p>\n
A listener’s TCP_FASTOPEN max_qlen stops being accurate and lets through
\nfar more pending Fast Open requests than it was configured for.<\/p>\n
This only shows up with SO_REUSEPORT listener migration, where closing a
\nlistener hands its still-pending TFO children over to a surviving one.<\/p>\n
fastopenq.qlen is charged in tcp_fastopen_create_child() when the child
\nis created and uncharged in reqsk_fastopen_remove() when the handshake
\ncompletes. The uncharge follows rsk_listener of the request the child
\npoints at, and inet_reqsk_clone() has repointed the child at a new
\nrequest owned by the new listener, so the ++ and the — land on two
\ndifferent sockets. The new listener’s qlen drifts negative and its
\nlimit no longer binds.<\/p>\n
Charge the new listener during migration, like reqsk_queue_migrated()
\nalready does for queue->young and queue->qlen.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: fix TFO max_qlen accounting across reuseport migration<\/p>\n
A listener’s TCP_FASTOPEN max_qlen stops being accurate and lets throu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11268","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}