Linux Kernel batman-adv Component Divide-By-Zero Vulnerability in TCP Congestion Window Calculation

A vulnerability in the Linux kernel's batman-adv networking component has been addressed. The issue was a divide-by-zero vulnerability in the TCP throughput meter implementation, specifically in the function batadv_tp_update_cwnd(). The problem arose because the congestion window (cwnd) value, which should always be between the maximum segment size (MSS) and 0x20000000, was incorrectly handled as an unsigned 32-bit value. When cwnd reached 0x20000000, it wrapped around to zero, leading to an invalid calculation that attempted to divide by zero. This vulnerability could potentially be exploited to cause a denial-of-service condition by manipulating the TCP congestion control parameters.

Impact

Exploitation of this vulnerability could lead to a denial-of-service condition by causing a division-by-zero error in the TCP throughput meter, disrupting normal network traffic management.

Reproduction

To reproduce this vulnerability, use a version of the Linux kernel that includes the batman-adv component with the original TCP congestion window calculation. The vulnerability can be triggered by setting the congestion window (cwnd) to 0x20000000, which causes it to wrap around to zero when the batadv_tp_update_cwnd() function is called, creating a divide-by-zero situation.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. The official Linux kernel Git repository includes the patched version.