{ "schema_version": "1.6.1", "id": "RPI-CVE-2024-27404", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2024-27404" ], "published": "2024-05-17T11:40:45Z", "summary": "mptcp: fix data races on remote_id", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data races on remote_id\n\nSimilar to the previous patch, address the data race on\nremote_id, adding the suitable ONCE annotations.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt2", "1:6.1.47-1+rpt4", "1:6.1.54-1+rpt2", "1:6.1.58-1+rpt2", "1:6.1.63-1+rpt1", "1:6.1.73-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi2-rpi-v8", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-2712", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v8", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi6-rpi-2712", "binary_version": "1:6.1.58-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi6-rpi-v8", "binary_version": "1:6.1.58-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi7-rpi-2712", "binary_version": "1:6.1.63-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi7-rpi-v8", "binary_version": "1:6.1.63-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi8-rpi-2712", "binary_version": "1:6.1.73-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi8-rpi-v8", "binary_version": "1:6.1.73-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt2": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.81" }, "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.81", "compiled_filter": false }, "1:6.1.54-1+rpt2": { "linux_commit": "2906f7abdc03d4a92b6b0e2e0c87ea2a9dffe8f7", "upstream_version": "6.1.54", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.81" }, "1:6.1.58-1+rpt2": { "linux_commit": "ccf1586ad0663fa91238ac56abf6340d6d740d18", "upstream_version": "6.1.58", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.81" }, "1:6.1.63-1+rpt1": { "linux_commit": null, "upstream_version": "6.1.63", "assessment": "upstream version (no usable Linux commit)", "upstream_fixed": "6.1.81" }, "1:6.1.73-1+rpt1": { "linux_commit": null, "upstream_version": "6.1.73", "assessment": "upstream version (no usable Linux commit)", "upstream_fixed": "6.1.81" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2024-27404" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/e64148635509bf13eea851986f5a0b150e5bd066" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/2dba5774e8ed326a78ad4339d921a4291281ea6e" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/987c3ed7297e5661bc7f448f06fc366e497ac9b2" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/967d3c27127e71a10ff5c083583a038606431b61" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:52:36Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.2, "cvss_v3_severity": "High", "scenario": "AV:N - Both sides of the race are driven by remote MPTCP protocol data \u2014 the peer's MP_JOIN SYN-ACK writes `remote_id` from softirq via `subflow_finish_connect()`, while the peer's RM_ADDR/ADD_ADDR options drive the concurrent path-manager reads in `mptcp_pm_nl_rm_addr_or_subflow()` and `fill_remote_addresses_vec()`. No local access is needed.\nAC:L - The remote peer controls both racing sides and their timing: it chooses when to emit the MP_JOIN SYN-ACK carrying `join_id` and when to send RM_ADDR/ADD_ADDR that schedules the PM worker, and it can repeat this across many subflows and connections until the window is hit.\nPR:N - An MPTCP-enabled listening service accepts connections from any unauthenticated remote peer, and subflow creation plus ADD_ADDR/RM_ADDR signalling occur as part of normal protocol operation with no credentials required.\nUI:N - The MPTCP option exchange and path-manager subflow handling happen automatically inside the kernel once a connection is accepted; no local user action is involved.\nS:U - The unsynchronized access and all resulting effects are confined to the kernel networking stack's own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - `remote_id` is a u8 that is never used as an array index or pointer, and the only value exposed is the peer's own address ID via diag/netlink; no kernel memory contents are disclosed.\nI:L - Inconsistent reads let the path manager act on a wrong subflow identity \u2014 bypassing the `deny_id0` join restriction in `fill_remote_addresses_vec()` and underflowing the u8 `pm.add_addr_accepted`/`pm.local_addr_used` counters \u2014 which is limited, non-arbitrary modification of kernel connection state.\nA:H - A mismatched `remote_id` compare in `mptcp_pm_nl_rm_addr_or_subflow()` causes `mptcp_subflow_shutdown()` and `mptcp_close_ssk()` to tear down subflows the peer did not ask to remove \u2014 potentially the last remaining one, collapsing the MPTCP connection \u2014 and this is remotely and repeatably triggerable without authentication." } } }