In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trigger a DSS corruption: TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5227 at net/mptcp/protocol.c:695 __mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695 Modules linked in: CPU: 0 UID: 0 PID: 5227 Comm: syz-executor350 Not tainted 6.11.0-syzkaller-08829-gaf9c191ac2a0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695 Code: 0f b6 dc 31 ff 89 de e8 b5 dd ea f5 89 d8 48 81 c4 50 01 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 98 da ea f5 90 <0f> 0b 90 e9 47 ff ff ff e8 8a da ea f5 90 0f 0b 90 e9 99 e0 ff ff RSP: 0018:ffffc90000006db8 EFLAGS: 00010246 RAX: ffffffff8ba9df18 RBX: 00000000000055f0 RCX: ffff888030023c00 RDX: 0000000000000100 RSI: 00000000000081e5 RDI: 00000000000055f0 RBP: 1ffff110062bf1ae R08: ffffffff8ba9cf12 R09: 1ffff110062bf1b8 R10: dffffc0000000000 R11: ffffed10062bf1b9 R12: 0000000000000000 R13: dffffc0000000000 R14: 00000000700cec61 R15: 00000000000081e5 FS: 000055556679c380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020287000 CR3: 0000000077892000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> move_skbs_to_msk net/mptcp/protocol.c:811 [inline] mptcp_data_ready+0x29c/0xa90 net/mptcp/protocol.c:854 subflow_data_ready+0x34a/0x920 net/mptcp/subflow.c:1490 tcp_data_queue+0x20fd/0x76c0 net/ipv4/tcp_input.c:5283 tcp_rcv_established+0xfba/0x2020 net/ipv4/tcp_input.c:6237 tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915 tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2350 ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 __netif_receive_skb_one_core net/core/dev.c:5662 [inline] __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5775 process_backlog+0x662/0x15b0 net/core/dev.c:6107 __napi_poll+0xcb/0x490 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:6962 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 do_softirq+0x11b/0x1e0 kernel/softirq.c:455 </IRQ> <TASK> __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline] __dev_queue_xmit+0x1764/0x3e80 net/core/dev.c:4451 dev_queue_xmit include/linux/netdevice.h:3094 [inline] neigh_hh_output include/net/neighbour.h:526 [inline] neigh_output include/net/neighbour.h:540 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 ip_local_out net/ipv4/ip_output.c:130 [inline] __ip_queue_xmit+0x118c/0x1b80 net/ipv4/ip_output.c:536 __tcp_transmit_skb+0x2544/0x3b30 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] tcp_mtu_probe net/ipv4/tcp_output.c:2547 [inline] tcp_write_xmit+0x641d/0x6bf0 net/ipv4/tcp_output.c:2752 __tcp_push_pending_frames+0x9b/0x360 net/ipv4/tcp_output.c:3015 tcp_push_pending_frames include/net/tcp.h:2107 [inline] tcp_data_snd_check net/ipv4/tcp_input.c:5714 [inline] tcp_rcv_established+0x1026/0x2020 net/ipv4/tcp_input.c:6239 tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915 sk_backlog_rcv include/net/sock.h:1113 [inline] __release_sock+0x214/0x350 net/core/sock.c:3072 release_sock+0x61/0x1f0 net/core/sock.c:3626 mptcp_push_ ---truncated---

The version of kernel installed on the remote host is prior to 5.15.173-118.169. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-060 advisory.

    2025-01-21: CVE-2024-50128 was added to this advisory.

    2025-01-21: CVE-2024-50257 was added to this advisory.

    2025-01-21: CVE-2024-50150 was added to this advisory.

    2025-01-21: CVE-2024-50247 was added to this advisory.

    2025-01-21: CVE-2024-50151 was added to this advisory.

    2025-01-21: CVE-2024-38538 was added to this advisory.

    2025-01-21: CVE-2023-52913 was added to this advisory.

    2025-01-21: CVE-2024-50127 was added to this advisory.

    2025-01-21: CVE-2024-26718 was added to this advisory.

    2025-01-21: CVE-2024-50143 was added to this advisory.

    2025-01-21: CVE-2024-50131 was added to this advisory.

    2025-01-21: CVE-2024-50036 was added to this advisory.

    2025-01-21: CVE-2024-50262 was added to this advisory.

    2025-01-21: CVE-2024-49996 was added to this advisory.

    2025-01-21: CVE-2024-50154 was added to this advisory.

    2025-01-21: CVE-2024-41080 was added to this advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix potential context UAFs (CVE-2023-52913)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-crypt, dm-verity: disable tasklets (CVE-2024-26718)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: xmit: make sure we have at least eth header len bytes (CVE-2024-38538)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix possible deadlock in io_register_iowq_max_workers() (CVE-2024-41080)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix buffer overflow when parsing NFS reparse points (CVE-2024-49996)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not delay dst_entries_add() in dst_release() (CVE-2024-50036)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix mptcp DSS corruption due to large pmtu xmit (CVE-2024-50083)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: fix use-after-free in taprio_change() (CVE-2024-50127)

    In the Linux kernel, the following vulnerability has been resolved:

    net: wwan: fix global oob in wwan_rtnl_policy (CVE-2024-50128)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Consider the NULL character when validating the event length (CVE-2024-50131)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: fix uninit-value use in udf_get_fileshortad (CVE-2024-50143)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: typec: altmode should keep reference to parent (CVE-2024-50150)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOBs when building SMB2_IOCTL request (CVE-2024-50151)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Check if more than chunk-size bytes are written (CVE-2024-50247)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: Fix use-after-free in get_info() (CVE-2024-50257)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.228-219.884. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2025-077 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix mptcp DSS corruption due to large pmtu xmit (CVE-2024-50083)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-794 advisory.

    2025-01-16: CVE-2024-49883 was added to this advisory.

    2025-01-16: CVE-2024-49882 was added to this advisory.

    2025-01-16: CVE-2024-50150 was added to this advisory.

    2025-01-16: CVE-2024-50186 was added to this advisory.

    2025-01-16: CVE-2023-52751 was added to this advisory.

    2025-01-16: CVE-2024-50127 was added to this advisory.

    2025-01-16: CVE-2024-49855 was added to this advisory.

    2025-01-16: CVE-2024-47742 was added to this advisory.

    2025-01-16: CVE-2024-46695 was added to this advisory.

    2025-01-16: CVE-2024-50131 was added to this advisory.

    2025-01-16: CVE-2024-49983 was added to this advisory.

    2025-01-16: CVE-2024-50154 was added to this advisory.

    2025-01-16: CVE-2024-50088 was added to this advisory.

    2025-01-16: CVE-2024-49936 was added to this advisory.

    2025-01-16: CVE-2024-50151 was added to this advisory.

    2025-01-16: CVE-2024-38632 was added to this advisory.

    2025-01-16: CVE-2024-49884 was added to this advisory.

    2025-01-16: CVE-2024-47701 was added to this advisory.

    2025-01-16: CVE-2024-49889 was added to this advisory.

    2025-01-16: CVE-2024-50155 was added to this advisory.

    2025-01-16: CVE-2024-35963 was added to this advisory.

    2025-01-16: CVE-2024-49860 was added to this advisory.

    2025-01-16: CVE-2024-47685 was added to this advisory.

    2025-01-16: CVE-2024-50143 was added to this advisory.

    2025-01-16: CVE-2024-50128 was added to this advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix use-after-free in smb2_query_info_compound() (CVE-2023-52751)

    In the Linux kernel, the following vulnerability has been resolved:

    Bluetooth: hci_sock: Fix not validating setsockopt user input (CVE-2024-35963)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: fix potential memory leak in vfio_intx_enable() (CVE-2024-38632)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux,smack: don't bypass permissions check in inode_setsecctx hook (CVE-2024-46695)

    syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits     (th->res1)

    Use skb_put_zero() to clear the whole TCP header, as done in nf_reject_ip_tcphdr_put() (CVE-2024-47685)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid OOB when system.data xattr changes underneath the filesystem (CVE-2024-47701)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware_loader: Block path traversal (CVE-2024-47742)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: fix race between timeout and normal completion (CVE-2024-49855)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: sysfs: validate return type of _STR method (CVE-2024-49860)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix double brelse() the buffer of the extents path (CVE-2024-49882)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: aovid use-after-free in ext4_ext_insert_extent() (CVE-2024-49883)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix slab-use-after-free in ext4_split_extent_at() (CVE-2024-49884)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid use-after-free in ext4_ext_show_leaf() (CVE-2024-49889)

    In the Linux kernel, the following vulnerability has been resolved:

    net/xen-netback: prevent UAF in xenvif_flush_hash() (CVE-2024-49936)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (CVE-2024-49983)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix mptcp DSS corruption due to large pmtu xmit (CVE-2024-50083)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix uninitialized pointer free in add_inode_ref() (CVE-2024-50088)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: fix use-after-free in taprio_change() (CVE-2024-50127)

    In the Linux kernel, the following vulnerability has been resolved:

    net: wwan: fix global oob in wwan_rtnl_policy (CVE-2024-50128)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Consider the NULL character when validating the event length (CVE-2024-50131)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: fix uninit-value use in udf_get_fileshortad (CVE-2024-50143)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: typec: altmode should keep reference to parent (CVE-2024-50150)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOBs when building SMB2_IOCTL request (CVE-2024-50151)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154)

    In the Linux kernel, the following vulnerability has been resolved:

    netdevsim: use cond_resched() in nsim_dev_trap_report_work() (CVE-2024-50155)

    In the Linux kernel, the following vulnerability has been resolved:

    net: explicitly clear the sk pointer, when pf->create fails (CVE-2024-50186)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50083 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to     large pmtu xmit Syzkaller was able to trigger a DSS corruption: TCP: request_sock_subflow_v4: Possible SYN     flooding on port [::]:20002. Sending cookies. ------------[ cut here ]------------ WARNING: CPU: 0 PID:
    5227 at net/mptcp/protocol.c:695 __mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695     Modules linked in: CPU: 0 UID: 0 PID: 5227 Comm: syz-executor350 Not tainted     6.11.0-syzkaller-08829-gaf9c191ac2a0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine,     BIOS Google 08/06/2024 RIP: 0010:__mptcp_move_skbs_from_subflow+0x20a9/0x21f0 net/mptcp/protocol.c:695     Code: 0f b6 dc 31 ff 89 de e8 b5 dd ea f5 89 d8 48 81 c4 50 01 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc     cc cc cc e8 98 da ea f5 90 <0f> 0b 90 e9 47 ff ff ff e8 8a da ea f5 90 0f 0b 90 e9 99 e0 ff ff RSP:
    0018:ffffc90000006db8 EFLAGS: 00010246 RAX: ffffffff8ba9df18 RBX: 00000000000055f0 RCX: ffff888030023c00     RDX: 0000000000000100 RSI: 00000000000081e5 RDI: 00000000000055f0 RBP: 1ffff110062bf1ae R08:
    ffffffff8ba9cf12 R09: 1ffff110062bf1b8 R10: dffffc0000000000 R11: ffffed10062bf1b9 R12: 0000000000000000     R13: dffffc0000000000 R14: 00000000700cec61 R15: 00000000000081e5 FS: 000055556679c380(0000)     GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    0000000020287000 CR3: 0000000077892000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000     DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ>     move_skbs_to_msk net/mptcp/protocol.c:811 [inline] mptcp_data_ready+0x29c/0xa90 net/mptcp/protocol.c:854     subflow_data_ready+0x34a/0x920 net/mptcp/subflow.c:1490 tcp_data_queue+0x20fd/0x76c0     net/ipv4/tcp_input.c:5283 tcp_rcv_established+0xfba/0x2020 net/ipv4/tcp_input.c:6237     tcp_v4_do_rcv+0x96d/0xc70 net/ipv4/tcp_ipv4.c:1915 tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2350     ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x341/0x5f0     net/ipv4/ip_input.c:233 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 NF_HOOK+0x3a4/0x450     include/linux/netfilter.h:314 __netif_receive_skb_one_core net/core/dev.c:5662 [inline]
    __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5775 process_backlog+0x662/0x15b0 net/core/dev.c:6107
    __napi_poll+0xcb/0x490 net/core/dev.c:6771 napi_poll net/core/dev.c:6840 [inline]     net_rx_action+0x89b/0x1240 net/core/dev.c:6962 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554     do_softirq+0x11b/0x1e0 kernel/softirq.c:455 </IRQ> <TASK> __local_bh_enable_ip+0x1bb/0x200     kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh     include/linux/rcupdate.h:919 [inline] __dev_queue_xmit+0x1764/0x3e80 net/core/dev.c:4451 dev_queue_xmit     include/linux/netdevice.h:3094 [inline] neigh_hh_output include/net/neighbour.h:526 [inline] neigh_output     include/net/neighbour.h:540 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 ip_local_out     net/ipv4/ip_output.c:130 [inline] __ip_queue_xmit+0x118c/0x1b80 net/ipv4/ip_output.c:536
    __tcp_transmit_skb+0x2544/0x3b30 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484     [inline] tcp_mtu_probe net/ipv4/tcp_output.c:2547 [inline] tcp_write_xmit+0x641d/0x6bf0     net/ipv4/tcp_output.c:2752 __tcp_push_pending_frames+0x9b/0x360 net/ipv4/tcp_output.c:3015     tcp_push_pending_frames include/net/tcp.h:2107 [inline] tcp_data_snd_check net/ipv4/tcp_input.c:5714     [inline] tcp_rcv_established+0x1026/0x2020 net/ipv4/tcp_input.c:6239 tcp_v4_do_rcv+0x96d/0xc70     net/ipv4/tcp_ipv4.c:1915 sk_backlog_rcv include/net/sock.h:1113 [inline] __release_sock+0x214/0x350     net/core/sock.c:3072 release_sock+0x61/0x1f0 net/core/sock.c:3626 mptcp_push_ ---truncated---     (CVE-2024-50083)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
213683	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2025-060)	Nessus	Amazon Linux Local Security Checks	high
213682	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-077)	Nessus	Amazon Linux Local Security Checks	high
213679	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-794)	Nessus	Amazon Linux Local Security Checks	critical
213470	Debian dla-4008 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	critical
213191	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2024-12887)	Nessus	Oracle Linux Local Security Checks	critical
212953	CBL Mariner 2.0 Security Update: kernel (CVE-2024-50083)	Nessus	MarinerOS Local Security Checks	high
211393	Photon OS 4.0: Linux PHSA-2024-4.0-0711	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2024-50083

high

Tenable Plugins

high

high

critical

critical

critical

high

high