In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state

Overview

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

Reject invalid net.ipv4.tcp_reordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp->reordering field for new sockets, so negative writes wrap to large values.

With tcp_mtu_probing=2, the wrapped value can overflow the tcp_mtu_probe() size calculation and drive the MTU probing path into an out-of-bounds read. Route tcp_reordering writes through proc_dointvec_minmax() and require it to be at least 1. Also require tcp_max_reordering to be at least 1 so the configured maximum cannot become negative either.

When registering the table for a non-init network namespace, relocate extra2 pointers that refer into init_net.ipv4 so the tcp_reordering upper bound follows that namespace's tcp_max_reordering.

Harden tcp_mtu_probe() itself by computing size_needed as u64. This keeps the send queue and window checks from being bypassed through signed integer overflow.

Affected

• linux_kernel >= 2.6.24.1, < 5.10.261
• linux_kernel >= 5.11, < 5.15.212
• linux_kernel >= 5.16, < 6.1.178
• linux_kernel >= 6.2, < 6.6.145
• linux_kernel >= 6.7, < 6.12.96
• linux_kernel >= 6.13, < 6.18.39
• linux_kernel >= 6.19, < 7.1.4
• linux_kernel = 2.6.24

Remediation

Upgrade past the affected range:

• linux_kernel 7.1.4