CVE-2024-35894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35894
In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent BPF accessing lowat from a subflow socket. Alexei reported the following splat: WARNING: CPU: 32 PID: 3276 at net/mptcp/subflow.c:1430 subflow_data_ready+0x147/0x1c0 Modules linked in: dummy bpf_testmod(O) [last unloaded: bpf_test_no_cfi(O)] CPU: 32 PID: 3276 Comm: test_progs Tainted: GO 6.8.0-12873-g2c43c33bfd23 Call Trace: <TASK> mptcp_set_rcvlowat+0x79/0x1d0 sk_setsockopt+0x6c0/0x1540 __bpf_setsockopt+0x6f/0x90 bpf_sock_ops_setsockopt+0x3c/0x90 bpf_prog_509ce5db2c7f9981_bpf_test_sockopt_int+0xb4/0x11b bpf_prog_dce07e362d941d2b_bpf_test_socket_sockopt+0x12b/0x132 bpf_prog_348c9b5faaf10092_skops_sockopt+0x954/0xe86 __cgroup_bpf_run_filter_sock_ops+0xbc/0x250 tcp_connect+0x879/0x1160 tcp_v6_connect+0x50c/0x870 mptcp_connect+0x129/0x280 __inet_stream_connect+0xce/0x370 inet_stream_connect+0x36/0x50 bpf_trampoline_6442491565+0x49/0xef inet_stream_connect+0x5/0x50 __sys_connect+0x63/0x90 __x64_sys_connect+0x14/0x20 The root cause of the issue is that bpf allows accessing mptcp-level proto_ops from a tcp subflow scope. Fix the issue detecting the problematic call and preventing any action.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3ffb1ab698376f09cc33101c07c1be229389fe29 Patch
https://git.kernel.org/stable/c/ee3c845787b621cfe82c2e52c513024a9d7a78f5 Patch
https://git.kernel.org/stable/c/fcf4692fa39e86a590c14a4af2de704e1d20a3b5 Patch
https://git.kernel.org/stable/c/3ffb1ab698376f09cc33101c07c1be229389fe29 Patch
https://git.kernel.org/stable/c/fcf4692fa39e86a590c14a4af2de704e1d20a3b5 Patch
https://security.netapp.com/advisory/ntap-20250321-0002/
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
History

21 Mar 2025, 18:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250321-0002/ -

30 Dec 2024, 17:09

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3ffb1ab698376f09cc33101c07c1be229389fe29 - () https://git.kernel.org/stable/c/3ffb1ab698376f09cc33101c07c1be229389fe29 - Patch
References () https://git.kernel.org/stable/c/ee3c845787b621cfe82c2e52c513024a9d7a78f5 - () https://git.kernel.org/stable/c/ee3c845787b621cfe82c2e52c513024a9d7a78f5 - Patch
References () https://git.kernel.org/stable/c/fcf4692fa39e86a590c14a4af2de704e1d20a3b5 - () https://git.kernel.org/stable/c/fcf4692fa39e86a590c14a4af2de704e1d20a3b5 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*

21 Nov 2024, 09:21

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3ffb1ab698376f09cc33101c07c1be229389fe29 - () https://git.kernel.org/stable/c/3ffb1ab698376f09cc33101c07c1be229389fe29 -
References () https://git.kernel.org/stable/c/fcf4692fa39e86a590c14a4af2de704e1d20a3b5 - () https://git.kernel.org/stable/c/fcf4692fa39e86a590c14a4af2de704e1d20a3b5 -

12 Aug 2024, 13:38

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/ee3c845787b621cfe82c2e52c513024a9d7a78f5 -
Summary
  • (es) En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: mptcp: impide que BPF acceda a lowat desde un socket de subflujo. Alexei informó el siguiente símbolo: ADVERTENCIA: CPU: 32 PID: 3276 en net/mptcp/subflow.c:1430 subflow_data_ready+0x147/0x1c0 Módulos vinculados en: ficticio bpf_testmod(O) [última descarga: bpf_test_no_cfi(O)] CPU: 32 PID: 3276 Comunicaciones: test_progs Contaminado: GO 6.8.0-12873-g2c43c33bfd23 Seguimiento de llamadas: mptcp_set_rcvlowat+0x79/0x1d0 sk_setsockopt+0x6c0/0x1540 __bpf_setsockopt+0x6f/0x90 ock_ops_setsockopt+0x3c/0x90 bpf_prog_509ce5db2c7f9981_bpf_test_sockopt_int+0xb4/0x11b bpf_prog_dce07e362d941d2b_bpf_test_socket_sockopt+0x12b /0x132 bpf_prog_348c9b5faaf10092_skops_sockopt+0x954/0xe86 __cgroup_bpf_run_filter_sock_ops+0xbc/0x250 tcp_connect+0x879/0x1160 tcp_v6_connect+0x50c/0x870 x129/0x280 __inet_stream_connect+0xce/0x370 inet_stream_connect+0x36/0x50 bpf_trampoline_6442491565+0x49/0xef inet_stream_connect+0x5/0x50 __sys_connect+0x63 /0x90 __x64_sys_connect+0x14/0x20 La causa principal del problema es que bpf permite acceder a proto_ops de nivel mptcp desde un alcance de subflujo tcp. Solucione el problema al detectar la llamada problemática y evitar cualquier acción.

19 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-19 09:15

Updated : 2025-03-21 18:15

NVD link : CVE-2024-35894

Mitre link : CVE-2024-35894

CVE.ORG link : CVE-2024-35894

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo