Vulnerability identifier: #VU91428

Vulnerability risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27404

CWE-ID: CWE-366

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the subflow_finish_connect(), __mptcp_subflow_connect() and subflow_ulp_clone() functions in net/mptcp/subflow.c, within the fill_remote_addresses_vec() and mptcp_pm_nl_rm_addr_or_subflow() functions in net/mptcp/pm_netlink.c. A local user can manipulate data.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/e64148635509bf13eea851986f5a0b150e5bd066
http://git.kernel.org/stable/c/2dba5774e8ed326a78ad4339d921a4291281ea6e
http://git.kernel.org/stable/c/987c3ed7297e5661bc7f448f06fc366e497ac9b2
http://git.kernel.org/stable/c/967d3c27127e71a10ff5c083583a038606431b61

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.