Cyber ·
Use-after-free flaw in Linux kernel with Multipath TCP may allow remote code execution
Reported on October 27, a remotely exploitable bug in open Multipath TCP listeners may expose kernel memory or cause a buffer overflow. The fix frees the structure only after an RCU grace period.
According to the advisory republished from the LWN feed, on October 27 an LLM provider reported a use-after-free flaw in the Linux kernel that can be exploited remotely on systems with open Multipath TCP listeners. The problem occurs when a response is generated to a retransmitted SYN packet at the same moment the TCP connection is being established in another thread. The first thread accesses the connection's options structure after the second thread has freed it. According to the text, this can lead to kernel memory disclosure or a buffer overflow with attacker-controlled payload. The described fix frees the structure only after an RCU grace period.
On October 29, the Go security team reported that programs written in Go use Multipath TCP by default, so many systems may be vulnerable without their operators knowing. The text also warns of possible related issues elsewhere in the TCP stack. Users may consider it prudent to update to a fixed kernel as soon as one is available for their distribution. To verify exposure, check in your own environment whether your kernel is affected and whether Multipath TCP listeners are open, and consult the original advisory and your distribution's bulletins. This text is an automatic translation of the feed and does not replace verification at the primary source.
Original source: Execução remota de código em sistemas Linux com Multipath TCP