GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-46858 (GCVE-0-2024-46858)

Vulnerability from cvelistv5 – Published: 2024-09-27 12:42 – Updated: 2026-08-05 11:39
VLAI
Title
mptcp: pm: Fix uaf in __timer_delete_sync
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_established mptcp_pm_remove_addrs_and_subflows tcp_data_queue remove_anno_list_by_saddr mptcp_incoming_options mptcp_pm_del_add_timer mptcp_pm_del_add_timer kfree(entry) In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1). Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer". Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 13:57 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 00cfd77b9063dcdf3628a7087faba60de85a9cc8 , < 0e7814b028cd50b3ff79659d23dfa9da6a1e75e1 (git)
Affected: 00cfd77b9063dcdf3628a7087faba60de85a9cc8 , < 3554482f4691571fc4b5490c17ae26896e62171c (git)
Affected: 00cfd77b9063dcdf3628a7087faba60de85a9cc8 , < 67409b358500c71632116356a0b065f112d7b707 (git)
Affected: 00cfd77b9063dcdf3628a7087faba60de85a9cc8 , < 6452b162549c7f9ef54655d3fb9977b9192e6e5b (git)
Affected: 00cfd77b9063dcdf3628a7087faba60de85a9cc8 , < 12134a652b0a10064844ea235173e70246eba6dc (git)
Affected: 00cfd77b9063dcdf3628a7087faba60de85a9cc8 , < b4cd80b0338945a94972ac3ed54f8338d2da2076 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.111 , ≤ 6.1.* (semver)
Unaffected: 6.6.52 , ≤ 6.6.* (semver)
Unaffected: 6.10.11 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T13:57:46.692938Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T13:57:52.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:19:44.734Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/pm_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e7814b028cd50b3ff79659d23dfa9da6a1e75e1",
              "status": "affected",
              "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
              "versionType": "git"
            },
            {
              "lessThan": "3554482f4691571fc4b5490c17ae26896e62171c",
              "status": "affected",
              "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
              "versionType": "git"
            },
            {
              "lessThan": "67409b358500c71632116356a0b065f112d7b707",
              "status": "affected",
              "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
              "versionType": "git"
            },
            {
              "lessThan": "6452b162549c7f9ef54655d3fb9977b9192e6e5b",
              "status": "affected",
              "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
              "versionType": "git"
            },
            {
              "lessThan": "12134a652b0a10064844ea235173e70246eba6dc",
              "status": "affected",
              "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
              "versionType": "git"
            },
            {
              "lessThan": "b4cd80b0338945a94972ac3ed54f8338d2da2076",
              "status": "affected",
              "version": "00cfd77b9063dcdf3628a7087faba60de85a9cc8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/pm_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.111",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.52",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: Fix uaf in __timer_delete_sync\n\nThere are two paths to access mptcp_pm_del_add_timer, result in a race\ncondition:\n\n     CPU1\t\t\t\tCPU2\n     ====                               ====\n     net_rx_action\n     napi_poll                          netlink_sendmsg\n     __napi_poll                        netlink_unicast\n     process_backlog                    netlink_unicast_kernel\n     __netif_receive_skb                genl_rcv\n     __netif_receive_skb_one_core       netlink_rcv_skb\n     NF_HOOK                            genl_rcv_msg\n     ip_local_deliver_finish            genl_family_rcv_msg\n     ip_protocol_deliver_rcu            genl_family_rcv_msg_doit\n     tcp_v4_rcv                         mptcp_pm_nl_flush_addrs_doit\n     tcp_v4_do_rcv                      mptcp_nl_remove_addrs_list\n     tcp_rcv_established                mptcp_pm_remove_addrs_and_subflows\n     tcp_data_queue                     remove_anno_list_by_saddr\n     mptcp_incoming_options             mptcp_pm_del_add_timer\n     mptcp_pm_del_add_timer             kfree(entry)\n\nIn remove_anno_list_by_saddr(running on CPU2), after leaving the critical\nzone protected by \"pm.lock\", the entry will be released, which leads to the\noccurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).\n\nKeeping a reference to add_timer inside the lock, and calling\nsk_stop_timer_sync() with this reference, instead of \"entry-\u003eadd_timer\".\n\nMove list_del(\u0026entry-\u003elist) to mptcp_pm_del_add_timer and inside the pm lock,\ndo not directly access any members of the entry outside the pm lock, which\ncan avoid similar \"entry-\u003ex\" uaf."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The use-after-free dereference occurs in the TCP/MPTCP receive path (`mptcp_incoming_options()` \u2192 `mptcp_pm_del_add_timer()`), driven entirely by an `ADD_ADDR` echo option in a TCP segment sent by the remote MPTCP peer, executed in softirq context. Any internet-facing MPTCP-enabled endpoint (server or Android/mobile client with a `signal` endpoint configured) processes this attacker-supplied option, so the vulnerable code is reached over the network.\nAC:H - The remote peer can hammer the racing side without limit by repeatedly sending ADD_ADDR echoes, but the freeing side must be executed concurrently by the local path manager (netlink FLUSH_ADDRS/DEL_ADDR, e.g. mptcpd reacting to an interface change), which is timing the attacker cannot influence. Winning that window is a condition beyond the remote attacker\u0027s control.\nPR:N - The attacker-controlled side requires only being the peer of an established MPTCP connection to a listening service \u2014 no account, credentials, or privileges on the target are needed, and the ADD_ADDR echo is accepted as part of normal protocol processing once the connection is fully established.\nUI:N - No victim action is required; the ADD_ADDR announcement and the peer\u0027s echo are automatic protocol behaviour, and the concurrent endpoint flush is performed by a background path-manager daemon rather than an interactive user.\nS:U - The corruption is confined to kernel heap memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The freed `mptcp_pm_add_entry` lives in a generic kmalloc cache and can be reclaimed with attacker-shaped data, and the subsequent `timer_delete_sync()`/`__sock_put()` on that stale object gives a foothold for arbitrary kernel memory disclosure, as is standard for slab use-after-free.\nI:H - `__timer_delete_sync()` on the reclaimed object acts on attacker-influenced `timer-\u003eflags` and can perform an hlist unlink write (`*pprev = next; next-\u003epprev = pprev`), and the spurious `__sock_put()` underflows the socket refcount \u2014 both yield write primitives leveragable for control-flow hijack. The same missing-lock defect also permits a double `kfree()` of the entry from two concurrent netlink removals.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free / kernel oops in softirq context (as reported by syzbot), and the resulting timer-base list corruption or socket refcount underflow causes a kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:03.201Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e7814b028cd50b3ff79659d23dfa9da6a1e75e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3554482f4691571fc4b5490c17ae26896e62171c"
        },
        {
          "url": "https://git.kernel.org/stable/c/67409b358500c71632116356a0b065f112d7b707"
        },
        {
          "url": "https://git.kernel.org/stable/c/6452b162549c7f9ef54655d3fb9977b9192e6e5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/12134a652b0a10064844ea235173e70246eba6dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4cd80b0338945a94972ac3ed54f8338d2da2076"
        }
      ],
      "title": "mptcp: pm: Fix uaf in __timer_delete_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46858",
    "datePublished": "2024-09-27T12:42:49.167Z",
    "dateReserved": "2024-09-11T15:12:18.291Z",
    "dateUpdated": "2026-08-05T11:39:03.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46858",
      "date": "2026-09-17",
      "epss": "0.00591",
      "percentile": "0.46766"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T02:59:30.000Z",
      "cve": "CVE-2024-46858",
      "id": "msrc_CVE-2024-46858",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mptcp: pm: Fix uaf in __timer_delete_sync",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46858.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46858\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-27T13:15:17.353\",\"lastModified\":\"2026-08-04T11:20:34.037\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: pm: Fix uaf in __timer_delete_sync\\n\\nThere are two paths to access mptcp_pm_del_add_timer, result in a race\\ncondition:\\n\\n     CPU1\\t\\t\\t\\tCPU2\\n     ====                               ====\\n     net_rx_action\\n     napi_poll                          netlink_sendmsg\\n     __napi_poll                        netlink_unicast\\n     process_backlog                    netlink_unicast_kernel\\n     __netif_receive_skb                genl_rcv\\n     __netif_receive_skb_one_core       netlink_rcv_skb\\n     NF_HOOK                            genl_rcv_msg\\n     ip_local_deliver_finish            genl_family_rcv_msg\\n     ip_protocol_deliver_rcu            genl_family_rcv_msg_doit\\n     tcp_v4_rcv                         mptcp_pm_nl_flush_addrs_doit\\n     tcp_v4_do_rcv                      mptcp_nl_remove_addrs_list\\n     tcp_rcv_established                mptcp_pm_remove_addrs_and_subflows\\n     tcp_data_queue                     remove_anno_list_by_saddr\\n     mptcp_incoming_options             mptcp_pm_del_add_timer\\n     mptcp_pm_del_add_timer             kfree(entry)\\n\\nIn remove_anno_list_by_saddr(running on CPU2), after leaving the critical\\nzone protected by \\\"pm.lock\\\", the entry will be released, which leads to the\\noccurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).\\n\\nKeeping a reference to add_timer inside the lock, and calling\\nsk_stop_timer_sync() with this reference, instead of \\\"entry-\u003eadd_timer\\\".\\n\\nMove list_del(\u0026entry-\u003elist) to mptcp_pm_del_add_timer and inside the pm lock,\\ndo not directly access any members of the entry outside the pm lock, which\\ncan avoid similar \\\"entry-\u003ex\\\" uaf.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mptcp:pm: Se corrige uaf en __timer_delete_sync Hay dos rutas para acceder a mptcp_pm_del_add_timer, lo que genera una condici\u00f3n de carrera: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_established mptcp_pm_remove_addrs_and_subflows tcp_data_queue remove_anno_list_by_saddr mptcp_incoming_options mptcp_pm_del_add_timer mptcp_pm_del_add_timer kfree(entrada) En remove_anno_list_by_saddr(que se ejecuta en la CPU2), despu\u00e9s de salir de la zona cr\u00edtica protegida por \\\"pm.lock\\\", se liberar\u00e1 la entrada, lo que lleva a la aparici\u00f3n de uaf en mptcp_pm_del_add_timer(que se ejecuta en la CPU1). Mantener una referencia a add_timer dentro del bloqueo y llamar a sk_stop_timer_sync() con esta referencia, en lugar de \\\"entrada-\u0026gt;add_timer\\\". Mueva list_del(\u0026amp;entry-\u0026gt;list) a mptcp_pm_del_add_timer y dentro del bloqueo pm, no acceda directamente a ning\u00fan miembro de la entrada fuera del bloqueo pm, lo que puede evitar un uaf \\\"entry-\u0026gt;x\\\" similar.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mptcp/pm_netlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"00cfd77b9063dcdf3628a7087faba60de85a9cc8\",\"lessThan\":\"0e7814b028cd50b3ff79659d23dfa9da6a1e75e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"00cfd77b9063dcdf3628a7087faba60de85a9cc8\",\"lessThan\":\"3554482f4691571fc4b5490c17ae26896e62171c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"00cfd77b9063dcdf3628a7087faba60de85a9cc8\",\"lessThan\":\"67409b358500c71632116356a0b065f112d7b707\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"00cfd77b9063dcdf3628a7087faba60de85a9cc8\",\"lessThan\":\"6452b162549c7f9ef54655d3fb9977b9192e6e5b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"00cfd77b9063dcdf3628a7087faba60de85a9cc8\",\"lessThan\":\"12134a652b0a10064844ea235173e70246eba6dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"00cfd77b9063dcdf3628a7087faba60de85a9cc8\",\"lessThan\":\"b4cd80b0338945a94972ac3ed54f8338d2da2076\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mptcp/pm_netlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.111\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.52\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.11\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T13:57:46.692938Z\",\"id\":\"CVE-2024-46858\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"6.1.111\",\"matchCriteriaId\":\"2B62FC78-DC08-42C4-9B1A-D1F4632DBBE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.52\",\"matchCriteriaId\":\"02ADDA94-95BB-484D-8E95-63C0428A28E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.11\",\"matchCriteriaId\":\"F5DB5367-F1F5-4200-B3B3-FDF8AFC3D255\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE5298B3-04B4-4F3E-B186-01A58B5C75A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e7814b028cd50b3ff79659d23dfa9da6a1e75e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/12134a652b0a10064844ea235173e70246eba6dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3554482f4691571fc4b5490c17ae26896e62171c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6452b162549c7f9ef54655d3fb9977b9192e6e5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/67409b358500c71632116356a0b065f112d7b707\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4cd80b0338945a94972ac3ed54f8338d2da2076\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:07:15+00:00",
      "cve": "CVE-2024-46858",
      "id": "CVE-2024-46858",
      "initial_release_date": "2024-09-27T00:00:00+00:00",
      "product_status:fixed": "1440",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: pm: Fix uaf in __timer_delete_sync",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46858.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:19:44.734Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46858\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T13:57:46.692938Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T13:57:48.385Z\"}}], \"cna\": {\"title\": \"mptcp: pm: Fix uaf in __timer_delete_sync\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"00cfd77b9063dcdf3628a7087faba60de85a9cc8\", \"lessThan\": \"0e7814b028cd50b3ff79659d23dfa9da6a1e75e1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"00cfd77b9063dcdf3628a7087faba60de85a9cc8\", \"lessThan\": \"3554482f4691571fc4b5490c17ae26896e62171c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"00cfd77b9063dcdf3628a7087faba60de85a9cc8\", \"lessThan\": \"67409b358500c71632116356a0b065f112d7b707\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"00cfd77b9063dcdf3628a7087faba60de85a9cc8\", \"lessThan\": \"6452b162549c7f9ef54655d3fb9977b9192e6e5b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"00cfd77b9063dcdf3628a7087faba60de85a9cc8\", \"lessThan\": \"12134a652b0a10064844ea235173e70246eba6dc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"00cfd77b9063dcdf3628a7087faba60de85a9cc8\", \"lessThan\": \"b4cd80b0338945a94972ac3ed54f8338d2da2076\", \"versionType\": \"git\"}], \"programFiles\": [\"net/mptcp/pm_netlink.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.111\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.52\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/mptcp/pm_netlink.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0e7814b028cd50b3ff79659d23dfa9da6a1e75e1\"}, {\"url\": \"https://git.kernel.org/stable/c/3554482f4691571fc4b5490c17ae26896e62171c\"}, {\"url\": \"https://git.kernel.org/stable/c/67409b358500c71632116356a0b065f112d7b707\"}, {\"url\": \"https://git.kernel.org/stable/c/6452b162549c7f9ef54655d3fb9977b9192e6e5b\"}, {\"url\": \"https://git.kernel.org/stable/c/12134a652b0a10064844ea235173e70246eba6dc\"}, {\"url\": \"https://git.kernel.org/stable/c/b4cd80b0338945a94972ac3ed54f8338d2da2076\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: pm: Fix uaf in __timer_delete_sync\\n\\nThere are two paths to access mptcp_pm_del_add_timer, result in a race\\ncondition:\\n\\n     CPU1\\t\\t\\t\\tCPU2\\n     ====                               ====\\n     net_rx_action\\n     napi_poll                          netlink_sendmsg\\n     __napi_poll                        netlink_unicast\\n     process_backlog                    netlink_unicast_kernel\\n     __netif_receive_skb                genl_rcv\\n     __netif_receive_skb_one_core       netlink_rcv_skb\\n     NF_HOOK                            genl_rcv_msg\\n     ip_local_deliver_finish            genl_family_rcv_msg\\n     ip_protocol_deliver_rcu            genl_family_rcv_msg_doit\\n     tcp_v4_rcv                         mptcp_pm_nl_flush_addrs_doit\\n     tcp_v4_do_rcv                      mptcp_nl_remove_addrs_list\\n     tcp_rcv_established                mptcp_pm_remove_addrs_and_subflows\\n     tcp_data_queue                     remove_anno_list_by_saddr\\n     mptcp_incoming_options             mptcp_pm_del_add_timer\\n     mptcp_pm_del_add_timer             kfree(entry)\\n\\nIn remove_anno_list_by_saddr(running on CPU2), after leaving the critical\\nzone protected by \\\"pm.lock\\\", the entry will be released, which leads to the\\noccurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1).\\n\\nKeeping a reference to add_timer inside the lock, and calling\\nsk_stop_timer_sync() with this reference, instead of \\\"entry-\u003eadd_timer\\\".\\n\\nMove list_del(\u0026entry-\u003elist) to mptcp_pm_del_add_timer and inside the pm lock,\\ndo not directly access any members of the entry outside the pm lock, which\\ncan avoid similar \\\"entry-\u003ex\\\" uaf.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.111\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.52\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.11\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-12-24T13:21:35.775Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46858\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-12-24T13:21:35.775Z\", \"dateReserved\": \"2024-09-11T15:12:18.291Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-27T12:42:49.167Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.