CVE-2024-53122

Katalog CVE

CVSS 5.5 · Medium EPSS 0,53%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs. A racing recvmsg() spooling data received on an already established subflow would unconditionally call tcp_cleanup_rbuf() on all the current subflows, potentially hitting a divide by zero error on the newly created ones. Explicitly check that the subflow is in a suitable state before invoking tcp_cleanup_rbuf().

Rincian

Terbit di NVD

2 Desember 2024

Terakhir diubah

4 Agustus 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/24995851d58c4a205ad0ffa7b2f21e479a9c8527 patch
• https://git.kernel.org/stable/c/aad6412c63baa39dd813e81f16a14d976b3de2e8 patch
• https://git.kernel.org/stable/c/ce7356ae35943cc6494cc692e62d51a734062b7d patch
• https://git.kernel.org/stable/c/ff825ab2f455299c0c7287550915a8878e2a66e0 patch
• https://git.kernel.org/stable/c/0a9a182ea5c7bb0374e527130fd85024ace7279b
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html