CVE-2024-46858

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: Fix uaf in __timer_delete_sync

There are two paths to access mptcp_pm_del_add_timer, result in a race

condition:

CPU1 CPU2

==== ====

net_rx_action

napi_poll netlink_sendmsg

__napi_poll netlink_unicast

process_backlog netlink_unicast_kernel

__netif_receive_skb genl_rcv

__netif_receive_skb_one_core netlink_rcv_skb

NF_HOOK genl_rcv_msg

ip_local_deliver_finish genl_family_rcv_msg

ip_protocol_deliver_rcu genl_family_rcv_msg_doit

tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit

tcp_v4_do_rcv mptcp_nl_remove_addrs_list

tcp_rcv_established mptcp_pm_remove_addrs_and_subflows

tcp_data_queue remove_anno_li

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References