In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: avoid possible UaF when selecting endp
selectlocaladdress() and selectsignaladdress() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free.
A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with.
[
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"32147185135854537242421183124811681765",
"319988539072099223714067387587437771084",
"178810666303227970993525993400808967962",
"315369770699373316898946824087186001049",
"221691933305136695411805751459116166190",
"277738273267493292110576783198689555766",
"313682872103556885374864996810254648737",
"259635170628898622179341509817187562808",
"284652638728350632570623408808195455421",
"42051867048343152527062972655244265855",
"115339984011134364311184426732926962929",
"215827790597586039275239385894840596693",
"36394570738104373452870575717566815751",
"247718821961127045233505684184163686046",
"103752785943773139999339538144020718942",
"80586141311026566633968813076120347617",
"337508830308879290111479033250467286001",
"277943699955468373898580379784252140833",
"102428256070375183415814246580283734545",
"18927865349139064736046278492296127391",
"105725499718471958568520622819032592453",
"232196667972432529373390132932606108860",
"277062454376132568914170991176891822257",
"246165918813108414127134569908266287573",
"152574964790898396522080336229176381119",
"20330588212221165009130271967700058791",
"215827790597586039275239385894840596693",
"258344850940093665697340177530525600461",
"328865431754518724558115628870921884894",
"239385678780868621351857765766831292840",
"108867556431903091569252267640938470363",
"27349174819705642090868972740017999965",
"327013753406880705516079887189627479258",
"109839425913505323147306492957719625627",
"234979486196483307621222055246245562854",
"247874948384663692406280973299367529612",
"114959636524142633775876332751217719458",
"138762009515186801559218264225983329130",
"95807956795399810880644404318844022030",
"132434974580359396250084657800977145099",
"96061982026098317958590425961682479969",
"240082351717293546030229829695769752685",
"170679651578735290077712843564608976211",
"253709927007748608762145656664768031081",
"204642633324667448704032821293102690765",
"103017342407458194484346756764560385630",
"15619067987282378816122705652018303337",
"220294442421989279619773240951018584177",
"315396244187839479472505471497742271425",
"168275731085909790035187487229657369562",
"30421230202511145474454394748949775009",
"36112954046008437661104813356300355949",
"52359214504470465432490695988518695792",
"279351767607694568312453781034688096420",
"8917024467421369662580284611143650740"
]
},
"id": "CVE-2024-44974-0f7b4d5b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_local_address"
},
"digest": {
"function_hash": "208748438565293617187711848786373833753",
"length": 711.0
},
"id": "CVE-2024-44974-1375353b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "mptcp_pm_create_subflow_or_signal_addr"
},
"digest": {
"function_hash": "47519842778507952431908771126419098120",
"length": 2227.0
},
"id": "CVE-2024-44974-13bf31ed",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b4f46f9503633dade75cb796dd1949d0e6581a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"32147185135854537242421183124811681765",
"319988539072099223714067387587437771084",
"221758767616513035849208619640388691082",
"280321204216731668165421459793271382057",
"304010012931803964824032536866158794428",
"211781421074632854198892592002057079425",
"262012296815974804601402821973406362313",
"211826263621760585635537675391406123639",
"283995319332661676443494703182564213855",
"327522838743511579752149586272514384615",
"154058546288628668185447763670154142136",
"80835481341634342089674613288080832385",
"205965501287326880919584768998649350422",
"239385678780868621351857765766831292840",
"337508830308879290111479033250467286001",
"292770777636426085446367804764357802259",
"115102068400372013856202301555144653854",
"174425308198745604462974576876272181804",
"296605802533199605023673727501801249179",
"71937578658969028649646660007328993727",
"134427384072923874577995773755611040502",
"321904550221263217630760479196570651090",
"276277262422405504267925621555495475708",
"154058546288628668185447763670154142136",
"80835481341634342089674613288080832385",
"205965501287326880919584768998649350422",
"239385678780868621351857765766831292840",
"210189601370493566391924844513339315403",
"219146162102894183507757935539696137601",
"27655460255982555134102579272152696836",
"337513056956326728670383515735679992252",
"280760696869286964660851944178046832961",
"178137887051667290413840815784635162699",
"135269590531159347670405485432094906244",
"322133626933633969246952998143881042415",
"235443303214932337337752970372302190850",
"307026036970851884322978563639394625634",
"249047223009587551458974127303070259507",
"178643452670128705505879902738693544513",
"262028824844747725269810037999743545349",
"103749829751847126350449662618629186162",
"198394875114804166973944720890676904222",
"150022775208866223087225907111174062765",
"77077227461161381845232346020668630358",
"155113055346399897872616471248442606602",
"39106884699879387499399372750757887622",
"10210525595774131796112830398786680063",
"4054393733266147825901886831584092614",
"332749932820202991639722068901697317446",
"268461426173016695666652173637042692236",
"279154635503404971140726700563003608262",
"287532930901988825128593143303576219819",
"35265773320678296893451409993098070733",
"321320981512687433131621886924610343847",
"234882214047081309437850942187987595271",
"24793787350224338006765024304884483246",
"22244140820133897369486490699946433233",
"225752769366352222191638493957625163627",
"63610659182501244845530420235837846035",
"3875270394469823111404967503882104884",
"27687597733256164366875475306272076521",
"265711381190881244224462652889864535527",
"18631330603257476984162465883692587758",
"147551233527505722631437682552839537067",
"257461832992862610619210460033582623628",
"276224466505244681019344494023119164028",
"178912086262973332004199779402416157314",
"122510681110326056715686490727312056452",
"314422289730158229616598179195259059034"
]
},
"id": "CVE-2024-44974-1a926bf7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "mptcp_pm_create_subflow_or_signal_addr"
},
"digest": {
"function_hash": "71045773989288237720342765782731714794",
"length": 2235.0
},
"id": "CVE-2024-44974-2f886c3a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_local_address"
},
"digest": {
"function_hash": "108751873843975355481640659229624358052",
"length": 406.0
},
"id": "CVE-2024-44974-45ce569d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_local_address"
},
"digest": {
"function_hash": "236434103979726709129619105251735475474",
"length": 715.0
},
"id": "CVE-2024-44974-66f9a7cd",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b4f46f9503633dade75cb796dd1949d0e6581a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_signal_address"
},
"digest": {
"function_hash": "329799609920953054983786052281423480361",
"length": 378.0
},
"id": "CVE-2024-44974-72d9e44a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b4f46f9503633dade75cb796dd1949d0e6581a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "mptcp_pm_create_subflow_or_signal_addr"
},
"digest": {
"function_hash": "71045773989288237720342765782731714794",
"length": 2235.0
},
"id": "CVE-2024-44974-77a10d8b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0201d65d9806d287a00e0ba96f0321835631f63f",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "mptcp_pm_create_subflow_or_signal_addr"
},
"digest": {
"function_hash": "200940778720103145356635898318175469983",
"length": 1423.0
},
"id": "CVE-2024-44974-9f0c6189",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_signal_address"
},
"digest": {
"function_hash": "91583509405959514291603525979008559084",
"length": 340.0
},
"id": "CVE-2024-44974-a8d413e5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_signal_address"
},
"digest": {
"function_hash": "267866613379508904935395228104900542144",
"length": 347.0
},
"id": "CVE-2024-44974-a9e960b2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"32147185135854537242421183124811681765",
"319988539072099223714067387587437771084",
"221758767616513035849208619640388691082",
"280321204216731668165421459793271382057",
"222953460594384578129342611925005601439",
"207602185398736737287072433224588002782",
"221557319182819501631615027417938324828",
"257697606019248683945979620269569742094",
"211826263621760585635537675391406123639",
"227475551115697710323329045288293222604",
"124126168724215299656016587456844437023",
"109057057373836494716266392665191111070",
"80835481341634342089674613288080832385",
"205965501287326880919584768998649350422",
"239385678780868621351857765766831292840",
"337508830308879290111479033250467286001",
"292770777636426085446367804764357802259",
"115102068400372013856202301555144653854",
"174425308198745604462974576876272181804",
"296605802533199605023673727501801249179",
"71937578658969028649646660007328993727",
"134427384072923874577995773755611040502",
"321904550221263217630760479196570651090",
"276277262422405504267925621555495475708",
"154058546288628668185447763670154142136",
"80835481341634342089674613288080832385",
"205965501287326880919584768998649350422",
"239385678780868621351857765766831292840",
"210189601370493566391924844513339315403",
"219146162102894183507757935539696137601",
"27655460255982555134102579272152696836",
"337513056956326728670383515735679992252",
"280760696869286964660851944178046832961",
"178137887051667290413840815784635162699",
"135269590531159347670405485432094906244",
"322133626933633969246952998143881042415",
"235443303214932337337752970372302190850",
"307026036970851884322978563639394625634",
"249047223009587551458974127303070259507",
"178643452670128705505879902738693544513",
"262028824844747725269810037999743545349",
"103749829751847126350449662618629186162",
"198394875114804166973944720890676904222",
"150022775208866223087225907111174062765",
"77077227461161381845232346020668630358",
"155113055346399897872616471248442606602",
"39106884699879387499399372750757887622",
"10210525595774131796112830398786680063",
"4054393733266147825901886831584092614",
"332749932820202991639722068901697317446",
"268461426173016695666652173637042692236",
"279154635503404971140726700563003608262",
"287532930901988825128593143303576219819",
"35265773320678296893451409993098070733",
"321320981512687433131621886924610343847",
"234882214047081309437850942187987595271",
"24793787350224338006765024304884483246",
"22244140820133897369486490699946433233",
"225752769366352222191638493957625163627",
"63610659182501244845530420235837846035",
"338832108283094539975977215674672879258",
"72003461132097715907168562935677474962",
"74290565761266122566888988592915812034",
"79337761404453530745552645574641047622",
"125455885544911991010546891447867739361",
"102597777692178587634611937558584426553",
"178912086262973332004199779402416157314",
"122510681110326056715686490727312056452",
"314422289730158229616598179195259059034"
]
},
"id": "CVE-2024-44974-ac9be5a4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b4f46f9503633dade75cb796dd1949d0e6581a1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "mptcp_pm_create_subflow_or_signal_addr"
},
"digest": {
"function_hash": "180166229061999990136530158089830755260",
"length": 1316.0
},
"id": "CVE-2024-44974-b38bd5ab",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"32147185135854537242421183124811681765",
"319988539072099223714067387587437771084",
"178810666303227970993525993400808967962",
"315369770699373316898946824087186001049",
"48495442994898326179982535163884616800",
"196414858054794587448729216845418396174",
"221557319182819501631615027417938324828",
"257697606019248683945979620269569742094",
"253473343133126069119083252274353853047",
"158883132436305440572739154689239912301",
"2729161180626127538158723088467262679",
"147269918598786482611979536865330566337",
"215827790597586039275239385894840596693",
"258344850940093665697340177530525600461",
"328865431754518724558115628870921884894",
"239385678780868621351857765766831292840",
"337508830308879290111479033250467286001",
"277943699955468373898580379784252140833",
"102428256070375183415814246580283734545",
"18927865349139064736046278492296127391",
"105725499718471958568520622819032592453",
"232196667972432529373390132932606108860",
"277062454376132568914170991176891822257",
"308162505268133151849252636205385335568",
"152574964790898396522080336229176381119",
"20330588212221165009130271967700058791",
"215827790597586039275239385894840596693",
"258344850940093665697340177530525600461",
"328865431754518724558115628870921884894",
"239385678780868621351857765766831292840",
"210189601370493566391924844513339315403",
"219146162102894183507757935539696137601",
"220912252181091266234883423510911128150",
"50047071226543374411220482466538924018",
"159191189284917193634867510344624570104",
"273400333849570072015100188785492276036",
"335631802809980119408667426109784959606",
"5142950612127853836275243011090164761",
"157310161489694474821662963601123526441",
"132434974580359396250084657800977145099",
"96061982026098317958590425961682479969",
"240082351717293546030229829695769752685",
"162178106480056760142550777714536882359",
"128603900464410181317143065449472012485",
"226310000825672362068165459093688136765",
"285410871637277415957738191399119842234",
"143350051841641658902738269685415707468",
"281067612161256733749307329080000698016",
"58573866853499979721569786448251885333",
"233930642548605120938980739664600950422",
"133091979393348285215513401689093362546",
"249252258288471727596805865142791670551",
"178912086262973332004199779402416157314",
"158090091255947969261634204855424266669",
"74177057077569924318676441853846023666"
]
},
"id": "CVE-2024-44974-b767acb4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2c865e9e3ca44fc06b5f73b29a954775e4dbb38",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_signal_address"
},
"digest": {
"function_hash": "329799609920953054983786052281423480361",
"length": 378.0
},
"id": "CVE-2024-44974-bd14b5b6",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@48e50dcbcbaaf713d82bf2da5c16aeced94ad07d",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"32147185135854537242421183124811681765",
"319988539072099223714067387587437771084",
"221758767616513035849208619640388691082",
"280321204216731668165421459793271382057",
"304010012931803964824032536866158794428",
"211781421074632854198892592002057079425",
"262012296815974804601402821973406362313",
"211826263621760585635537675391406123639",
"283995319332661676443494703182564213855",
"327522838743511579752149586272514384615",
"154058546288628668185447763670154142136",
"80835481341634342089674613288080832385",
"205965501287326880919584768998649350422",
"239385678780868621351857765766831292840",
"337508830308879290111479033250467286001",
"292770777636426085446367804764357802259",
"115102068400372013856202301555144653854",
"174425308198745604462974576876272181804",
"296605802533199605023673727501801249179",
"71937578658969028649646660007328993727",
"134427384072923874577995773755611040502",
"321904550221263217630760479196570651090",
"276277262422405504267925621555495475708",
"154058546288628668185447763670154142136",
"80835481341634342089674613288080832385",
"205965501287326880919584768998649350422",
"239385678780868621351857765766831292840",
"210189601370493566391924844513339315403",
"219146162102894183507757935539696137601",
"27655460255982555134102579272152696836",
"337513056956326728670383515735679992252",
"280760696869286964660851944178046832961",
"178137887051667290413840815784635162699",
"135269590531159347670405485432094906244",
"322133626933633969246952998143881042415",
"235443303214932337337752970372302190850",
"307026036970851884322978563639394625634",
"249047223009587551458974127303070259507",
"178643452670128705505879902738693544513",
"262028824844747725269810037999743545349",
"103749829751847126350449662618629186162",
"198394875114804166973944720890676904222",
"150022775208866223087225907111174062765",
"77077227461161381845232346020668630358",
"155113055346399897872616471248442606602",
"39106884699879387499399372750757887622",
"10210525595774131796112830398786680063",
"4054393733266147825901886831584092614",
"332749932820202991639722068901697317446",
"268461426173016695666652173637042692236",
"279154635503404971140726700563003608262",
"287532930901988825128593143303576219819",
"35265773320678296893451409993098070733",
"321320981512687433131621886924610343847",
"234882214047081309437850942187987595271",
"24793787350224338006765024304884483246",
"22244140820133897369486490699946433233",
"225752769366352222191638493957625163627",
"63610659182501244845530420235837846035",
"3875270394469823111404967503882104884",
"27687597733256164366875475306272076521",
"265711381190881244224462652889864535527",
"18631330603257476984162465883692587758",
"147551233527505722631437682552839537067",
"257461832992862610619210460033582623628",
"276224466505244681019344494023119164028",
"178912086262973332004199779402416157314",
"122510681110326056715686490727312056452",
"314422289730158229616598179195259059034"
]
},
"id": "CVE-2024-44974-c7da8dbb",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0201d65d9806d287a00e0ba96f0321835631f63f",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_local_address"
},
"digest": {
"function_hash": "108751873843975355481640659229624358052",
"length": 406.0
},
"id": "CVE-2024-44974-cb693c4a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0201d65d9806d287a00e0ba96f0321835631f63f",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_signal_address"
},
"digest": {
"function_hash": "329799609920953054983786052281423480361",
"length": 378.0
},
"id": "CVE-2024-44974-d64de988",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0201d65d9806d287a00e0ba96f0321835631f63f",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/mptcp/pm_netlink.c",
"function": "select_local_address"
},
"digest": {
"function_hash": "332938508078319199800272281322528108016",
"length": 566.0
},
"id": "CVE-2024-44974-f26fcc46",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ddee5b4b6a1cc03c1e9921cf34382e094c2009f1",
"signature_version": "v1"
}
]