In the Linux kernel, the following vulnerability has been resolved:
tcp: avoid too many retransmit packets
If a TCP socket is using TCPUSERTIMEOUT, and the other peer retracted its window to zero, tcpretransmittimer() can retransmit a packet every two jiffies (2 ms for HZ=1000), for about 4 minutes after TCPUSERTIMEOUT has 'expired'.
The fix is to make sure tcprtxprobe0timedout() takes icsk->icskusertimeout into account.
Before blamed commit, the socket would not timeout after icsk->icskusertimeout, but would use standard exponential backoff for the retransmits.
Also worth noting that before commit e89688e3e978 ("net: tcp: fix unexcepted socket die when snd_wnd is 0"), the issue would last 2 minutes instead of 4.
[
{
"id": "CVE-2024-41007-07bae6c1",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "tcp_rtx_probe0_timed_out",
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97a9063518f198ec0adb2ecb89789de342bb8283",
"digest": {
"length": 304.0,
"function_hash": "152989993673335583394342864668985235294"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-41007-09ec64fe",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "tcp_rtx_probe0_timed_out",
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04317a2471c2f637b4c49cbd0e9c0d04a519f570",
"digest": {
"length": 408.0,
"function_hash": "285298648831519488056466700119608636056"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-41007-2f394760",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4",
"digest": {
"line_hashes": [
"329595622440087565210835328218398717212",
"6063682922560719286411644090237491992",
"240792406586349709529170138708312310838",
"329912520482012776006227258502903111429",
"32863093369403090342145672684183819439",
"198167281048065786353044212031438680586",
"124200764310867304694386203403134675819",
"23068540234687885708018833936269598360",
"234064630816096640862090115749890864353",
"71638571884962081080256429107728135863",
"102960227184482319817787182097309753804",
"38314733611588049261603186045835908213",
"271332532160860824229032029930364945037"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-41007-367f27f7",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "tcp_rtx_probe0_timed_out",
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfcdd7f89e401d2c6616be90c76c2fac3fa98fde",
"digest": {
"length": 408.0,
"function_hash": "285298648831519488056466700119608636056"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-41007-3684f95a",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97a9063518f198ec0adb2ecb89789de342bb8283",
"digest": {
"line_hashes": [
"6994797826364457927797488839224128757",
"184095814123723052367882527873684491313",
"63734811008396355201477463797603885523",
"243645069614756756266311017794662185353",
"204158551818256128134909888814507191863",
"56166757575468655869748219732384490804",
"23068540234687885708018833936269598360",
"78520929413295147435346620133660628637"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-41007-430c5903",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "tcp_rtx_probe0_timed_out",
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2346fca5bed130dc712f276ac63450201d52969",
"digest": {
"length": 408.0,
"function_hash": "285298648831519488056466700119608636056"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-41007-63ed610d",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e113cddefa27bbf5a79f72387b8fbd432a61a466",
"digest": {
"line_hashes": [
"329595622440087565210835328218398717212",
"6063682922560719286411644090237491992",
"240792406586349709529170138708312310838",
"329912520482012776006227258502903111429",
"32863093369403090342145672684183819439",
"198167281048065786353044212031438680586",
"124200764310867304694386203403134675819",
"23068540234687885708018833936269598360",
"234064630816096640862090115749890864353",
"71638571884962081080256429107728135863",
"102960227184482319817787182097309753804",
"38314733611588049261603186045835908213",
"271332532160860824229032029930364945037"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-41007-77a05dd1",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04317a2471c2f637b4c49cbd0e9c0d04a519f570",
"digest": {
"line_hashes": [
"329595622440087565210835328218398717212",
"6063682922560719286411644090237491992",
"240792406586349709529170138708312310838",
"329912520482012776006227258502903111429",
"32863093369403090342145672684183819439",
"198167281048065786353044212031438680586",
"124200764310867304694386203403134675819",
"23068540234687885708018833936269598360",
"234064630816096640862090115749890864353",
"71638571884962081080256429107728135863",
"102960227184482319817787182097309753804",
"38314733611588049261603186045835908213",
"271332532160860824229032029930364945037"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-41007-7b5a7326",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d7e64d70a11d988553a08239c810a658e841982",
"digest": {
"line_hashes": [
"329595622440087565210835328218398717212",
"6063682922560719286411644090237491992",
"240792406586349709529170138708312310838",
"329912520482012776006227258502903111429",
"32863093369403090342145672684183819439",
"198167281048065786353044212031438680586",
"124200764310867304694386203403134675819",
"23068540234687885708018833936269598360",
"234064630816096640862090115749890864353",
"71638571884962081080256429107728135863",
"102960227184482319817787182097309753804",
"38314733611588049261603186045835908213",
"271332532160860824229032029930364945037"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-41007-af64e208",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2346fca5bed130dc712f276ac63450201d52969",
"digest": {
"line_hashes": [
"329595622440087565210835328218398717212",
"6063682922560719286411644090237491992",
"240792406586349709529170138708312310838",
"329912520482012776006227258502903111429",
"32863093369403090342145672684183819439",
"198167281048065786353044212031438680586",
"124200764310867304694386203403134675819",
"23068540234687885708018833936269598360",
"234064630816096640862090115749890864353",
"71638571884962081080256429107728135863",
"102960227184482319817787182097309753804",
"38314733611588049261603186045835908213",
"271332532160860824229032029930364945037"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-41007-c5908498",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "tcp_rtx_probe0_timed_out",
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4",
"digest": {
"length": 408.0,
"function_hash": "285298648831519488056466700119608636056"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-41007-cbb763e4",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfcdd7f89e401d2c6616be90c76c2fac3fa98fde",
"digest": {
"line_hashes": [
"329595622440087565210835328218398717212",
"6063682922560719286411644090237491992",
"240792406586349709529170138708312310838",
"329912520482012776006227258502903111429",
"32863093369403090342145672684183819439",
"198167281048065786353044212031438680586",
"124200764310867304694386203403134675819",
"23068540234687885708018833936269598360",
"234064630816096640862090115749890864353",
"71638571884962081080256429107728135863",
"102960227184482319817787182097309753804",
"38314733611588049261603186045835908213",
"271332532160860824229032029930364945037"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2024-41007-e4b96a88",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "tcp_rtx_probe0_timed_out",
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e113cddefa27bbf5a79f72387b8fbd432a61a466",
"digest": {
"length": 408.0,
"function_hash": "285298648831519488056466700119608636056"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-41007-f69e15e8",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "tcp_rtx_probe0_timed_out",
"file": "net/ipv4/tcp_timer.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d7e64d70a11d988553a08239c810a658e841982",
"digest": {
"length": 408.0,
"function_hash": "285298648831519488056466700119608636056"
},
"signature_type": "Function"
}
]