CVE-2023-54176
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-54176
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54176.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-54176
- Downstream
- Published
- 2025-12-30T12:08:48.915Z
- Modified
- 2025-12-30T20:23:47.740077Z
- Summary
- mptcp: stricter state check in mptcp_worker
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
mptcp: stricter state check in mptcp_worker
As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state:
connect() // incoming reset + fastclose // the mptcp worker is scheduled mptcpdisconnect() // msk is now CLOSED listen() mptcpworker()
Leading to the following splat:
divide error: 0000 [#1] PREEMPT SMP CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcpworker RIP: 0010:tcpselectwindow+0x22c/0x4b0 net/ipv4/tcpoutput.c:3018 RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004 RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000 R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcpselectwindow net/ipv4/tcpoutput.c:262 [inline] _tcptransmitskb+0x356/0x1280 net/ipv4/tcpoutput.c:1345 tcptransmitskb net/ipv4/tcpoutput.c:1417 [inline] tcpsendactivereset+0x13e/0x320 net/ipv4/tcpoutput.c:3459 mptcpcheckfastclose net/mptcp/protocol.c:2530 [inline] mptcpworker+0x6c7/0x800 net/mptcp/protocol.c:2705 processonework+0x3bd/0x950 kernel/workqueue.c:2390 workerthread+0x5b/0x610 kernel/workqueue.c:2537 kthread+0x138/0x170 kernel/kthread.c:376 retfromfork+0x2c/0x50 arch/x86/entry/entry_64.S:308 </TASK>
This change addresses the issue explicitly checking for bad states before running the mptcp worker.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54176.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/19ea79e87af32c2b3c6fc49bd84efeb35ca57678
- https://git.kernel.org/stable/c/aff9099e9c51f15c8def05c75b2b73e8487b5d54
- https://git.kernel.org/stable/c/d6a0443733434408f2cbd4c53fea6910599bab9e
- https://git.kernel.org/stable/c/f0b4a4086cf27240fc621a560da9735159049dcc
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54176.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-54176
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede16163b6e2b720fb74e5af758546f6dad27e6c9eFixedf0b4a4086cf27240fc621a560da9735159049dccFixedaff9099e9c51f15c8def05c75b2b73e8487b5d54Fixed19ea79e87af32c2b3c6fc49bd84efeb35ca57678Fixedd6a0443733434408f2cbd4c53fea6910599bab9e