Linux Kernel MPTCP TCP Options Overflow Vulnerability

A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation has been identified, which can lead to data stream corruption. This issue arises from a bug in the computation of MPTCP option lengths, particularly with the ADD_ADDR option, which can interfere with the previously established DSS option. The vulnerability was reported by Syzbot, highlighting a general protection fault related to non-canonical addresses, indicating a null pointer dereference. The flaw allows for improper handling of TCP options, potentially leading to a privilege escalation.

Impact

The vulnerability causes a corruption of TCP option information, specifically within the MPTCP protocol, which could disrupt data streams and potentially lead to a privilege escalation, according to the author.

Remediation

Users can apply the latest patches from the Linux kernel stable tree to address this vulnerability.