Executive brief
A vulnerability in the Linux kernel's TCP implementation could allow a local user to cause a system crash. The issue exists in the Data Center TCP (DCTCP) congestion control module, where certain configuration parameters were not properly validated. By providing an extremely large value to these parameters, an attacker can trigger an internal error that halts the operating system.
Technical details
A shift-out-of-bounds vulnerability exists in net/ipv4/tcp_dctcp.c within the dctcp_update_alpha() function. The root cause is a lack of bounds checking on the 'dctcp_shift_g' module parameter, which is used as a shift exponent. An attacker with local access to modify module parameters (via sysfs) can set 'dctcp_shift_g' to a value (e.g., 100) that exceeds the bit-width of the target 32-bit integer, triggering a kernel panic or undefined behavior. The fix implements a maximum value limit of 10 for this parameter using param_set_uint_minmax().
Affected products
- Linux Linux Kernel 5.16 to 6.9.4
Timeline
- 2024-05-17: patched: Initial patch submitted by Kuniyuki Iwashima
- 2024-06-21: disclosed: CVE published
References
- https://git.kernel.org/stable/c/02261d3f9dc7d1d7be7d778f839e3404ab99034c
- https://git.kernel.org/stable/c/06d0fe049b51b0a92a70df8333fd85c4ba3eb2c6
- https://git.kernel.org/stable/c/237340dee373b97833a491d2e99fcf1d4a9adafd
- https://git.kernel.org/stable/c/3ebc46ca8675de6378e3f8f40768e180bb8afa66
- https://git.kernel.org/stable/c/6aacaa80d962f4916ccf90e2080306cec6c90fcf
- https://git.kernel.org/stable/c/8602150286a2a860a1dc55cbd04f99316f19b40a
- https://git.kernel.org/stable/c/e65d13ec00a738fa7661925fd5929ab3c765d4be