CVE-2023-53490

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix disconnect vs accept race

Despite commit 0ad529d9fd2b ("mptcp: fix possible divide by zero in

recvmsg()"), the mptcp protocol is still prone to a race between

disconnect() (or shutdown) and accept.

The root cause is that the mentioned commit checks the msk-level

flag, but mptcp_stream_accept() does acquire the msk-level lock,

as it can rely directly on the first subflow lock.

As reported by Christoph than can lead to a race where an msk

socket is accepted after that mptcp_subflow_queue_clean() releases

the listener socket lock and just before it takes destructive

actions leading to the following splat:

BUG: kernel NULL pointer dereference, address: 0000000000000012

PGD 5a4ca067 P4D 5a4ca067 PUD 37d4c067 PMD 0

Oops: 0000 [#1] PREEMPT SMP

CPU: 2 PID: 10955 Comm: syz-executor.5 Not tainted 6.5.0-rc1-gdc7b257ee5dd #37

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014

RIP: 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References