Bug 1221968 (CVE-2021-47152)

Summary: VUL-0: CVE-2021-47152: kernel: mptcp: fix data stream corruption
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: gabriel.bertazi, gabriele.sonnu
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/398799/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-47152:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-03-26 10:49:16 UTC 
In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix data stream corruption

Maxim reported several issues when forcing a TCP transparent proxy
to use the MPTCP protocol for the inbound connections. He also
provided a clean reproducer.

The problem boils down to 'mptcp_frag_can_collapse_to()' assuming
that only MPTCP will use the given page_frag.

If others - e.g. the plain TCP protocol - allocate page fragments,
we can end-up re-using already allocated memory for mptcp_data_frag.

Fix the issue ensuring that the to-be-expanded data fragment is
located at the current page frag end.

v1 -> v2:
 - added missing fixes tag (Mat)

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-47152
https://www.cve.org/CVERecord?id=CVE-2021-47152
https://git.kernel.org/stable/c/18e7f0580da15cac1e79d73683ada5a9e70980f8
https://git.kernel.org/stable/c/29249eac5225429b898f278230a6ca2baa1ae154
https://git.kernel.org/stable/c/3267a061096efc91eda52c2a0c61ba76e46e4b34
https://bugzilla.redhat.com/show_bug.cgi?id=2271475
Comment 1 Gabriele Sonnu 2024-03-26 13:19:43 UTC 
Offending commit (18b683bff89d) found in:
 - ALP-current
 - cve/linux-5.14-LTSS
 - SLE15-SP4-LTSS
 - SLE15-SP5
 - SLE15-SP6
 - stable

Fixing commit (29249eac5225) found in:
 - ALP-current
 - cve/linux-5.14-LTSS
 - SLE15-SP4-LTSS
 - SLE15-SP5
 - SLE15-SP6
 - stable

All branches fixed. @kernel-team, please add the CVE reference.
Comment 2 Gabriel Krisman Bertazi 2024-04-26 23:07:17 UTC 
All references are now added, sending back to the security team.
Comment 3 Andrea Mattiazzo 2024-05-31 13:04:50 UTC 
All done, closing.