mptcp: handle consistently DSS corruption (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.56 % · percentile 47 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: handle consistently DSS corruption Bugged peer implementation can send corrupted DSS options, consistently hitting a few warning in the data path. Use DEBUG_NET assertions, to avoid the splat on some builds and handle consistently the error, dumping related MIBs and performing fallback and/or reset according to the subflow type.
References
- https://git.kernel.org/stable/c/fde99e972b8f88cebe619241d7aa43d288ef666a
- https://git.kernel.org/stable/c/12c1676d598e3b8dd92a033b623b792cc2ea1ec5
- https://git.kernel.org/stable/c/35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25
- https://git.kernel.org/stable/c/b8be15d1ae7ea4eedd547c3b3141f592fbddcd30
- https://git.kernel.org/stable/c/8bfd391bde685df7289b928ce8876a3583be4bfb
- https://git.kernel.org/stable/c/e32d262c89e2b22cb0640223f953b548617ed8a6
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H | Linux |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2024-44687
- GCVE · GCVE-0-2024-50185
CERT-FR advisories
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0366 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0349 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0276 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0234 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0212 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0185 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0184 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0183 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0168 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0152 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.7 < 5.10.228cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.169cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.113cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.57cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.11.4cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 6771bfd9ee2460c13e38c0cd46a3afb5404ae716 < fde99e972b8f88cebe619241d7aa43d288ef666a ; affected 6771bfd9ee2460c13e38c0cd46a3afb5404ae716 < 12c1676d598e3b8dd92a033b623b792cc2ea1ec5 ; affected 6771bfd9ee2460c13e38c0cd46a3afb5404ae716 < 35668f8ec84f6c944676e48ecc6bbc5fc8e6fe25 ; affected 6771bfd9ee2460c13e38c0cd46a3afb5404ae716 < b8be15d1ae7ea4eedd547c3b3141f592fbddcd30 ; affected 6771bfd9ee2460c13e38c0cd46a3afb5404ae716 < 8bfd391bde685df7289b928ce8876a3583be4bfb ; affected 6771bfd9ee2460c13e38c0cd46a3afb5404ae716 < e32d262c89e2b22cb0640223f953b548617ed8a6 |
| Linux · Linux | affected 5.7 ; unaffected 0 < 5.7 ; unaffected 5.10.228 ≤ 5.10.* ; unaffected 5.15.169 ≤ 5.15.* ; unaffected 6.1.113 ≤ 6.1.* ; unaffected 6.6.57 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |