Bug 2329932 (CVE-2024-53122)

Summary:	CVE-2024-53122 kernel: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dfreiber, drow, iwienand, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A divide by zero flaw was found in the Linux kernel's Multipath TCP (MPTCP). This issue could allow a remote user to crash the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2329945
Bug Blocks:

Description OSIDB Bzimport 2024-12-02 14:02:18 UTC

In the Linux kernel, the following vulnerability has been resolved:

mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

Additional active subflows - i.e. created by the in kernel path
manager - are included into the subflow list before starting the
3whs.

A racing recvmsg() spooling data received on an already established
subflow would unconditionally call tcp_cleanup_rbuf() on all the
current subflows, potentially hitting a divide by zero error on
the newly created ones.

Explicitly check that the subflow is in a suitable state before
invoking tcp_cleanup_rbuf().

Comment 1 Robb Gatica 2024-12-02 14:29:24 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024120252-CVE-2024-53122-f35c@gregkh/T

Comment 4 errata-xmlrpc 2025-01-08 00:08:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:0050 https://access.redhat.com/errata/RHSA-2025:0050

Comment 5 errata-xmlrpc 2025-01-08 00:18:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:0056 https://access.redhat.com/errata/RHSA-2025:0056

Comment 6 errata-xmlrpc 2025-01-08 00:20:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2025:0060 https://access.redhat.com/errata/RHSA-2025:0060

Comment 7 errata-xmlrpc 2025-01-08 00:21:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:0064 https://access.redhat.com/errata/RHSA-2025:0064

Comment 8 errata-xmlrpc 2025-01-08 00:22:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:0066 https://access.redhat.com/errata/RHSA-2025:0066

Comment 9 errata-xmlrpc 2025-01-08 00:25:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:0049 https://access.redhat.com/errata/RHSA-2025:0049

Comment 10 errata-xmlrpc 2025-01-08 00:29:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:0058 https://access.redhat.com/errata/RHSA-2025:0058

Comment 11 errata-xmlrpc 2025-01-08 00:32:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2025:0053 https://access.redhat.com/errata/RHSA-2025:0053

Comment 12 errata-xmlrpc 2025-01-08 00:35:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2025:0051 https://access.redhat.com/errata/RHSA-2025:0051

Comment 13 errata-xmlrpc 2025-01-08 00:36:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:0052 https://access.redhat.com/errata/RHSA-2025:0052

Comment 14 errata-xmlrpc 2025-01-08 00:36:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:0055 https://access.redhat.com/errata/RHSA-2025:0055

Comment 15 errata-xmlrpc 2025-01-08 00:37:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:0054 https://access.redhat.com/errata/RHSA-2025:0054

Comment 16 errata-xmlrpc 2025-01-08 00:44:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2025:0061 https://access.redhat.com/errata/RHSA-2025:0061

Comment 17 errata-xmlrpc 2025-01-08 00:51:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:0065 https://access.redhat.com/errata/RHSA-2025:0065

Comment 18 errata-xmlrpc 2025-01-08 01:21:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2025:0062 https://access.redhat.com/errata/RHSA-2025:0062

Comment 19 errata-xmlrpc 2025-01-08 01:24:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:0059 https://access.redhat.com/errata/RHSA-2025:0059

Comment 20 errata-xmlrpc 2025-01-08 01:33:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:0057 https://access.redhat.com/errata/RHSA-2025:0057

Comment 21 errata-xmlrpc 2025-01-08 02:29:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

Via RHSA-2025:0067 https://access.redhat.com/errata/RHSA-2025:0067

Comment 22 errata-xmlrpc 2025-01-08 02:48:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:0063 https://access.redhat.com/errata/RHSA-2025:0063

Comment 23 errata-xmlrpc 2025-01-08 19:07:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:0109 https://access.redhat.com/errata/RHSA-2025:0109