CVE-2024-46858

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_e...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 0e7814b028cd50b3ff79659d23dfa9da6a1e75e1, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 3554482f4691571fc4b5490c17ae26896e62171c, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 67409b358500c71632116356a0b065f112d7b707, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 6452b162549c7f9ef54655d3fb9977b9192e6e5b, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < 12134a652b0a10064844ea235173e70246eba6dc, >= 00cfd77b9063dcdf3628a7087faba60de85a9cc8 < b4cd80b0338945a94972ac3ed54f8338d2da2076, >= 5.10, >= 5.10 < 6.1.111, >= 6.2 < 6.6.52, >= 6.7 < 6.10.11, 6.11

Fixed versions

6.1.111, 6.6.52, 6.10.11

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416