CVE-2024-26708

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26708
In the Linux kernel, the following vulnerability has been resolved: mptcp: really cope with fastopen race Fastopen and PM-trigger subflow shutdown can race, as reported by syzkaller. In my first attempt to close such race, I missed the fact that the subflow status can change again before the subflow_state_change callback is invoked. Address the issue additionally copying with all the states directly reachable from TCP_FIN_WAIT1.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f Patch
https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2 Patch
https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f Patch
https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f Patch
https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2 Patch
https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
History

08 Apr 2025, 15:31

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
CWE CWE-362
References () https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f - () https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f - Patch
References () https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2 - () https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2 - Patch
References () https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f - () https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f - Patch

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f - () https://git.kernel.org/stable/c/337cebbd850f94147cee05252778f8f78b8c337f -
References () https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2 - () https://git.kernel.org/stable/c/4bfe217e075d04e63c092df9d40c608e598c2ef2 -
References () https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f - () https://git.kernel.org/stable/c/e158fb9679d15a2317ec13b4f6301bd26265df2f -

04 Nov 2024, 22:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp: realmente se adapta a la ejecución fastopen. El cierre del subflujo Fastopen y PM-trigger puede correr, según lo informado por syzkaller. En mi primer intento de cerrar dicha ejecución, me perdí el hecho de que el estado del subflujo puede cambiar nuevamente antes de que se invoque la devolución de llamada subflow_state_change. Solucione el problema copiando adicionalmente todos los estados a los que se puede acceder directamente desde TCP_FIN_WAIT1.

03 Apr 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-03 15:15

Updated : 2025-04-08 15:31

NVD link : CVE-2024-26708

Mitre link : CVE-2024-26708

CVE.ORG link : CVE-2024-26708

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')