cve/published/2024/CVE-2024-36889.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-36889: mptcp: ensure snd_nxt is properly initialized on connect

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mptcp: ensure snd_nxt is properly initialized on connect

Christoph reported a splat hinting at a corrupted snd_una:

  WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005
  Modules linked in:
  CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
  Workqueue: events mptcp_worker
  RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005
  Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8
  	8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe
  	<0f> 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9
  RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293
  RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4
  RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001
  RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
  R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000
  R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000
  FS:  0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0
  Call Trace:
   <TASK>
   __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline]
   mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline]
   __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615
   mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767
   process_one_work+0x1e0/0x560 kernel/workqueue.c:3254
   process_scheduled_works kernel/workqueue.c:3335 [inline]
   worker_thread+0x3c7/0x640 kernel/workqueue.c:3416
   kthread+0x121/0x170 kernel/kthread.c:388
   ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147
   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
   </TASK>

When fallback to TCP happens early on a client socket, snd_nxt
is not yet initialized and any incoming ack will copy such value
into snd_una. If the mptcp worker (dumbly) tries mptcp-level
re-injection after such ack, that would unconditionally trigger a send
buffer cleanup using 'bad' snd_una values.

We could easily disable re-injection for fallback sockets, but such
dumb behavior already helped catching a few subtle issues and a very
low to zero impact in practice.

Instead address the issue always initializing snd_nxt (and write_seq,
for consistency) at connect time.

The Linux kernel CVE team has assigned CVE-2024-36889 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.9 with commit 8fd738049ac3d67a937d36577763b47180aae1ad and fixed in 5.10.218 with commit 99951b62bf20cec9247f633a3bea898338b9e5b4
	Issue introduced in 5.9 with commit 8fd738049ac3d67a937d36577763b47180aae1ad and fixed in 5.15.159 with commit dc941fec0719d0471a5902424d6b2a17df233193
	Issue introduced in 5.9 with commit 8fd738049ac3d67a937d36577763b47180aae1ad and fixed in 6.1.91 with commit 39ca83ed73db9edcc6d70c0dc7a73085a4725012
	Issue introduced in 5.9 with commit 8fd738049ac3d67a937d36577763b47180aae1ad and fixed in 6.6.31 with commit aa0c07c1f20e05b30019bff083ec43665536f06f
	Issue introduced in 5.9 with commit 8fd738049ac3d67a937d36577763b47180aae1ad and fixed in 6.8.10 with commit 592f69b41766d366dbb8ff4ef5a67c4396527bbe
	Issue introduced in 5.9 with commit 8fd738049ac3d67a937d36577763b47180aae1ad and fixed in 6.9 with commit fb7a0d334894206ae35f023a82cad5a290fd7386

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-36889
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mptcp/protocol.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/99951b62bf20cec9247f633a3bea898338b9e5b4
	https://git.kernel.org/stable/c/dc941fec0719d0471a5902424d6b2a17df233193
	https://git.kernel.org/stable/c/39ca83ed73db9edcc6d70c0dc7a73085a4725012
	https://git.kernel.org/stable/c/aa0c07c1f20e05b30019bff083ec43665536f06f
	https://git.kernel.org/stable/c/592f69b41766d366dbb8ff4ef5a67c4396527bbe
	https://git.kernel.org/stable/c/fb7a0d334894206ae35f023a82cad5a290fd7386