CVE-2024-26708

MEDIUM Year: 2024
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-362
View all →

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: really cope with fastopen race Fastopen and PM-trigger subflow shutdown can race, as reported by syzkaller. In my first attempt to close such race, I missed the fact that the subflow status can change again before the subflow_state_change callback is invoked. Address the issue additionally copying with all the states directly reachable from TCP_FIN_WAIT1.

Related Vulnerabilities

CVE-2014-0196

MEDIUM
CVSS:5.5(Medium)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial o...

CWE-3622014

CVE-2015-7550

MEDIUM
CVSS:5.5(Medium)

The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereferen...

CWE-3622015

CVE-2016-7916

MEDIUM
CVSS:5.5(Medium)

Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file d...

CWE-3622016

CVE-2017-14483

MEDIUM
CVSS:5.5(Medium)

flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by lever...

CWE-3622017

CVE-2017-5427

MEDIUM
CVSS:5.5(Medium)

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced fi...

CWE-3622017

CVE-2017-5986

MEDIUM
CVSS:5.5(Medium)

Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithre...

CWE-3622017