In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0<\/p>\n
The in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement
\nentry alive when removing the id 0 endpoint. This happens because the id 0
\nremoval path does not tear down pending announcements, unlike the non-zero
\nid path.<\/p>\n
When the PM later reselects id 0 after adding another signal endpoint, it
\nfinds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel())
\nin mptcp_pm_announced_alloc().<\/p>\n
Root cause: asymmetry between removal paths.
\n– Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls
\n mptcp_pm_remove_announced() to clean up.
\n– Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely.<\/p>\n
Fix by making the id 0 path symmetric: call mptcp_pm_announced_remove()
\nand decrement add_addr_signaled before queuing the RM_ADDR.<\/p>\n
Subtle detail: signal endpoints are stored in anno_list with port 0, but
\nmsk_local carries the connection’s local port. In other words, entries
\nlinked to ID0 paths should have port == 0. A follow-up patch will ensure
\nthat. mptcp_pm_announced_remove() uses use_port=true for comparison. So
\nclear the port before the lookup.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0<\/p>\n
The in-kernel MPTCP path manager can leave a stale ADD_ADDR announcemen<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28998","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}