CVE-2024-45009

mptcp: pm: only decrement add_addr_accepted for MPJ req

State: Published
Severity: 8.2 High
Published: Sep 11, 2024
Updated: Aug 5, 2026
Reserved: Aug 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: only decrement add_addr_accepted for MPJ req

Adding the following warning ...

WARN_ON_ONCE(msk->pm.add_addr_accepted == 0)

... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest.

Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon the reception of the RM_ADDR, the other peer will then try to decrement this add_addr_accepted. That's not correct because the attached subflows have not been created upon the reception of an ADD_ADDR.

A way to solve that is to decrement the counter only if the attached subflow was an MP_JOIN to a remote id that was not 0, and initiated by the host receiving the RM_ADDR.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d0876b2284cf8b34dd214b2d0aa21071c345da59 to before 35b31f5549ede4070566b949781e83495906b43dAffected d0876b2284cf8b34dd214b2d0aa21071c345da59 to before 85b866e4c4e63a1d7afb58f1e24273caad03d0b7Affected d0876b2284cf8b34dd214b2d0aa21071c345da59 to before d20bf2c96d7ffd171299b32f562f70e5bf5dc608Affected d0876b2284cf8b34dd214b2d0aa21071c345da59 to before 2060f1efab370b496c4903b840844ecaff324c3cAffected d0876b2284cf8b34dd214b2d0aa21071c345da59 to before 1c1f721375989579e46741f59523e39ec9b2a9bdAffected
LinuxLinux	5.10Affected before 5.10Not affected 5.15.167 through 5.15.Not affected 6.1.107 through 6.1.Not affected 6.6.48 through 6.6.Not affected 6.10.7 through 6.10.Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

d0876b2284cf8b34dd214b2d0aa21071c345da59 to before 35b31f5549ede4070566b949781e83495906b43dAffected
d0876b2284cf8b34dd214b2d0aa21071c345da59 to before 85b866e4c4e63a1d7afb58f1e24273caad03d0b7Affected
d0876b2284cf8b34dd214b2d0aa21071c345da59 to before d20bf2c96d7ffd171299b32f562f70e5bf5dc608Affected
d0876b2284cf8b34dd214b2d0aa21071c345da59 to before 2060f1efab370b496c4903b840844ecaff324c3cAffected
d0876b2284cf8b34dd214b2d0aa21071c345da59 to before 1c1f721375989579e46741f59523e39ec9b2a9bdAffected

LinuxLinux

5.10Affected
before 5.10Not affected
5.15.167 through 5.15.*Not affected
6.1.107 through 6.1.*Not affected
6.6.48 through 6.6.*Not affected
6.10.7 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.