CVE-2022-48906

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

CVE-2022-48906

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

CVE-2022-48906

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

CVE-2022-48906

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

CVE-2022-48906 mptcp: Correctly set DATA_FIN timeout when number of retransmits is large

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

CVE-2022-48906 mptcp: Correctly set DATA_FIN timeout when number of retransmits is large

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

CVE-2022-48906 mptcp: Correctly set DATA_FIN timeout when number of retransmits is large

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

CVE-2022-48906

CVE-2022-48906 affects the Linux kernel MPTCP implementation (DATA_FIN timeout calculation in net/mptcp/protocol.c). Syzkaller/UBSAN revealed a shift-out-of-bounds when many DATA_FIN retransmits occur, causing timeout miscalculation. The fix limits the maximum timeout by restricting the shift siz...

CVE-2022-48906: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mptcp: Correctly set DATAFIN timeout when number of retransmits is large Syzkaller with UBSAN uncovered a scenario where a large number of DATAFIN retransmits caused a shift-out-of-bounds in the DATAFIN timeout calculation:...

PT-2024-31361

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel's handling of the add addr accepted counter in the mptcp module. When a 'subflow' endpoint is removed, it triggers a RM ADDR and then the subflow...

PT-2024-5927

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50 Description The issue is related to the select local address and select signal address functions in the Linux kernel's mptcp component. These functions select an endpoint entry from a list inside an RCU...

F5 Networks BIG-IP : BIG-IP MPTCP vulnerability (K000138477)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10 / 16.1.5 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000138477 advisory. When a TCP profile with Multipath TCP enabled MPTCP is configured on a virtual server, undisclosed traffic...

CVE-2024-41164 BIG-IP MPTCP vulnerability

When TCP profile with Multipath TCP enabled MPTCP is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000138477: BIG-IP MPTCP vulnerability CVE-2024-41164

Security Advisory Description When a TCP profile with Multipath TCP enabled MPTCP is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel TMM to terminate. CVE-2024-41164 Impact Traffic is disrupted...

CVE-2024-41164: NULL Pointer Dereference

When TCP profile with Multipath TCP enabled MPTCP is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2024:2896-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2896-1 advisory. The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were...

SUSE-SU-2024:2896-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-41014: xfs: add bounds checking to xlogrecoverprocessdata bsc1228408. - CVE-2024-41013: xfs: do not walk off the end of a directory data block...

CVE-2024-40931

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snduna is properly initialized on connect This is strictly related to commit fb7a0d334894 "mptcp: ensure sndnxt is properly initialized on connect". It turns out that syzkaller can trigger the retransmit after...

kernel security and bug fix update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

RLSA-2024:4211 Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack CVE-2020-26555 kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number...