CVE-2024-35840

What it actually does

The flaw allows uninitialized fields (backup, join_id, thmac, none) to be used in subflow_finish_connect() when OPTION_MPTCP_MPJ_SYNACK is not set during option parsing, potentially disclosing kernel memory contents.

Why it matters to the business

Attackers could potentially leak sensitive kernel data over network connections using MPTCP, increasing risk of information exposure in Linux-based systems, though exploitation likelihood remains low based on current metrics.

How an attack unfolds

An attacker establishes an MPTCP connection and manipulates subflow options so that mptcp_parse_option does not set the required flag, causing subflow_finish_connect to process garbage data from the fields, which may contain sensitive information that gets transmitted.

How to fix it

Update the Linux kernel to the fixed commit 413b913507326972135d2977975dbff8b7f2c453 or later stable versions incorporating this change.

How to confirm the fix worked

Verify the commit is present in the kernel source; test MPTCP subflow connections to ensure no uninitialized data usage.

Typical attack path

1. Initiate MPTCP handshake
2. Send crafted SYNACK without proper MPJ option
3. Trigger subflow finish connect
4. Observe leaked data in responses

How to detect it

Inspect kernel logs for MPTCP errors or unusual subflow behaviors; look for network traffic anomalies in MPTCP sessions.

What your security team should do

• Prioritize kernel updates on systems using MPTCP
• Monitor for MPTCP-related anomalies
• Apply patches promptly despite low EPSS