CVE-2024-45009

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) path manager. A remote attacker could potentially exploit an issue where the add_addr_accepted counter is incorrectly decremented during subflow removal. This can lead to an inconsistent state within the MPTCP connection, potentially resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Multipath TCP (MPTCP) kernel module if it is not required. This prevents the vulnerable code path from being loaded.

To blacklist the mptcp module:

1. Create /etc/modprobe.d/disable-mptcp.conf with:

   blacklist mptcp
   install mptcp /bin/true
   

2. Regenerate the initramfs:

   dracut -f -v
   

   or mkinitrd -f /boot/initramfs-$(uname -r).img $(uname -r)
3. Reboot the system.

Alternatively, disable MPTCP at runtime:

sysctl -w net.mptcp.enabled=0

For persistent disablement, add net.mptcp.enabled = 0 to /etc/sysctl.conf or a file in /etc/sysctl.d/. A system reboot or service reload may be required for changes to take full effect.