In the Linux kernel, the following vulnerability has been resolved:
mptcp: avoid unneeded actions on subflow reset
Once in a blue moon, the mptcp receive path can recursively call
mptcp_data_ready() via state change under unlucky error conditions, and
then try to hold the data lock again.
Break the recursion loop explicitly checking for the exceptional
condition.
Add a new flag instead of using an existing one like 'closing', to exit
early in subflow_state_change(), and explicitly flush the RX queue at
reset time.
This avoids unneeded processing to check for available data -- calling
get_mapping_status() and more on a dying subflow -- but also in error
reporting and worker scheduling.
Note that we must consume the currently peeked skb before invoking
mptcp_dss_corruption to avoid consuming it again after the eventual
reset has freed it.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5
AV:N - A crafted MPTCP DSS option on a received TCP segment is the attacker-controlled input; it is parsed on the established RX path tcp_rcv_established → tcp_data_queue → subflow_data_ready → mptcp_data_ready → __mptcp_move_skbs_from_subflow, which calls mptcp_dss_corruption() and then the patched mptcp_subflow_reset()/subflow_state_change(). MPTCP/TCP is a routable IP protocol.
AC:L - The peer disables infinite fallback via MP_JOIN (mptcp_subflow_joined(); allow_join_initial_addr_port defaults to 1) or by filling msk->out_of_order_queue, then sends a DSS with data_len shorter than the skb plus another TCP-ofo segment so map_remaining < len in __mptcp_move_skbs_from_subflow() calls mptcp_subflow_reset() while ssk->sk_receive_queue is still occupied, making subflow_state_change() re-enter mptcp_data_ready().
PR:N - The DSS is processed in TCP receive softirq after an unauthenticated MP_CAPABLE handshake with an IPPROTO_MPTCP listener (or an outbound MPTCP client); no local account, capability, or application credential is checked on the path to mptcp_dss_corruption().
UI:N - The attacker’s DSS segments are handled entirely in RX softirq on an existing MPTCP connection; no local user mount, file open, or other victim action is required.
S:U - The recursive mptcp_data_lock hang and subflow teardown stay inside the victim kernel’s network stack; no VM, IOMMU, or sandbox boundary is crossed.
C:N - The defect is a nested spin_lock_bh on sk->sk_lock.slock from subflow_state_change() back into mptcp_data_ready(); it does not read attacker-chosen kernel memory or leak pointers.
I:N - Pre-fix tcp_done() does not purge ssk->sk_receive_queue, and the nested mptcp_data_ready() never proceeds past the already-held slock, so there is no use-after-free, write primitive, or control-flow hijack.
A:H - mptcp_data_ready() already holds mptcp_data_lock (spin_lock_bh on sk->sk_lock.slock) when mptcp_dss_corruption() → mptcp_subflow_reset() → tcp_done() invokes subflow_state_change(), which re-enters mptcp_data_ready() and deadlocks the CPU in softirq (soft lockup).
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
None |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:N - A crafted MPTCP DSS option on a received TCP segment is the attacker-controlled input; it is parsed on the established RX path tcp_rcv_established → tcp_data_queue → subflow_data_ready → mptcp_data_ready → __mptcp_move_skbs_from_subflow, which calls mptcp_dss_corruption() and then the patched mptcp_subflow_reset()/subflow_state_change(). MPTCP/TCP is a routable IP protocol.
AC:L - The peer disables infinite fallback via MP_JOIN (mptcp_subflow_joined(); allow_join_initial_addr_port defaults to 1) or by filling msk->out_of_order_queue, then sends a DSS with data_len shorter than the skb plus another TCP-ofo segment so map_remaining < len in __mptcp_move_skbs_from_subflow() calls mptcp_subflow_reset() while ssk->sk_receive_queue is still occupied, making subflow_state_change() re-enter mptcp_data_ready().
PR:N - The DSS is processed in TCP receive softirq after an unauthenticated MP_CAPABLE handshake with an IPPROTO_MPTCP listener (or an outbound MPTCP client); no local account, capability, or application credential is checked on the path to mptcp_dss_corruption().
UI:N - The attacker’s DSS segments are handled entirely in RX softirq on an existing MPTCP connection; no local user mount, file open, or other victim action is required.
S:U - The recursive mptcp_data_lock hang and subflow teardown stay inside the victim kernel’s network stack; no VM, IOMMU, or sandbox boundary is crossed.
C:N - The defect is a nested spin_lock_bh on sk->sk_lock.slock from subflow_state_change() back into mptcp_data_ready(); it does not read attacker-chosen kernel memory or leak pointers.
I:N - Pre-fix tcp_done() does not purge ssk->sk_receive_queue, and the nested mptcp_data_ready() never proceeds past the already-held slock, so there is no use-after-free, write primitive, or control-flow hijack.
A:H - mptcp_data_ready() already holds mptcp_data_lock (spin_lock_bh on sk->sk_lock.slock) when mptcp_dss_corruption() → mptcp_subflow_reset() → tcp_done() invokes subflow_state_change(), which re-enters mptcp_data_ready() and deadlocks the CPU in softirq (soft lockup).
CVSS 3.1