mptcp: pm: avoid possible UaF when selecting endp

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2024-44974
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-09-04 20:15:07 UTC
Updated2026-04-09 17:41:57 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-416

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Debian Debian Linux 11.0 All All All
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 ddee5b4b6a1cc03c1e9921cf34382e094c2009f1 git Not specified
CNA Linux Linux affected 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 f2c865e9e3ca44fc06b5f73b29a954775e4dbb38 git Not specified
CNA Linux Linux affected 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 2b4f46f9503633dade75cb796dd1949d0e6581a1 git Not specified
CNA Linux Linux affected 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8 git Not specified
CNA Linux Linux affected 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 0201d65d9806d287a00e0ba96f0321835631f63f git Not specified
CNA Linux Linux affected 01cacb00b35cb62b139f07d5f84bcf0eeda8eff6 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d git Not specified
CNA Linux Linux affected 5.7 Not specified
CNA Linux Linux unaffected 5.7 semver Not specified
CNA Linux Linux unaffected 5.10.226 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.167 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.109 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.48 6.6.* semver Not specified
CNA Linux Linux unaffected 6.10.7 6.10.* semver Not specified
CNA Linux Linux unaffected 6.11 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/48e50dcbcbaaf713d82bf2da5c16aeced94ad07d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/9a9afbbc3fbfca4975eea4aa5b18556db5a0c0b8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/0201d65d9806d287a00e0ba96f0321835631f63f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/f2c865e9e3ca44fc06b5f73b29a954775e4dbb38 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/ddee5b4b6a1cc03c1e9921cf34382e094c2009f1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2024/10/msg00003.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
git.kernel.org/stable/c/2b4f46f9503633dade75cb796dd1949d0e6581a1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/01/msg00001.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report