mirror of
https://github.com/0xMarcio/cve.git
synced 2026-02-12 18:42:46 +00:00
1.4 KiB
1.4 KiB
CVE-2021-47132
Description
In the Linux kernel, the following vulnerability has been resolved:mptcp: fix sk_forward_memory corruption on retransmissionMPTCP sk_forward_memory handling is a bit special, as such fieldis protected by the msk socket spin_lock, instead of the plainsocket lock.Currently we have a code path updating such field without handlingthe relevant lock:__mptcp_retrans() -> __mptcp_clean_una_wakeup()Several helpers in __mptcp_clean_una_wakeup() will updatesk_forward_alloc, possibly causing such field corruption, as reportedby Matthieu.Address the issue providing and using a new variant of blamed functionwhich explicitly acquires the msk spin lock.
POC
Reference
No PoCs from references.