CVE-2021-47594

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: never allow the PM to close a listener subflow

Currently, when deleting an endpoint the netlink PM treverses

all the local MPTCP sockets, regardless of their status.

If an MPTCP listener socket is bound to the IP matching the

delete endpoint, the listener TCP socket will be closed.

That is unexpected, the PM should only affect data subflows.

Additionally, syzbot was able to trigger a NULL ptr dereference

due to the above:

general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]

CPU: 1 PID: 6550 Comm: syz-executor122 Not tainted 5.16.0-rc4-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:__lock_acquire+0xd7d/0x54a0 kernel/locking/lockdep.c:4897

Code: 0f 0e 41 be 01 00 00 00 0f 86 c8 00 00 00 89 05 69 cc 0f 0e e9 bd 00 00 00

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References