CVE-2024-45010

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: only mark 'subflow' endp as available

Adding the following warning ...

WARN_ON_ONCE(msk->pm.local_addr_used == 0)

... before decrementing the local_addr_used counter helped to find a bug

when running the "remove single address" subtest from the mptcp_join.sh

selftests.

Removing a 'signal' endpoint will trigger the removal of all subflows

linked to this endpoint via mptcp_pm_nl_rm_addr_or_subflow() with

rm_type == MPTCP_MIB_RMSUBFLOW. This will decrement the local_addr_used

counter, which is wrong in this case because this counter is linked to

'subflow' endpoints, and here it is a 'signal' endpoint that is being

removed.

Now, the counter is decremented, only if the ID is being used outside

of mptcp_pm_nl_rm_addr_or_subflow(), only for 'subflow' endpoints, and

if the ID is not 0 -- local_addr_used is not taking into account these

ones. This marking of the ID as being available, and the decrement is

don

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References