CVE-2024-40931

This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It turns out that syzkaller can trigger the retransmit after fallback and before processing any other incoming packet - so that snd_una is still left uninitialized.

Address the issue explicitly initializing snd_una together with snd_nxt and write_seq.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40931.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8fd738049ac3d67a937d36577763b47180aae1ad

Fixed

208cd22ef5e57f82d38ec11c1a1703f9401d6dde

Fixed

7b9c7fc8600b64a86e4b47b2d190bba380267726

Fixed

f03c46eabb3a67bd2993e237ab5517f00a5f1813

Fixed

f1f0a46f8bb8890b90ab7194f0a0c8fe2a3fb57f

Fixed

ef473bf1dd7e8dd08bcc04b9e2d1bfed69a0a7ce

Fixed

8031b58c3a9b1db3ef68b3bd749fbee2e1e1aaa3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-40931.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.9.0

Fixed

5.10.221

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.162

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.95

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.35

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.9.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-40931.json"