Remote code execution on Linux systems with multipath TCP
On October 27, LLM provider Anthropic reported on a remotely exploitable use-after-free bug affecting systems with multipath TCP listeners open. The bug works by triggering a response to a retransmitted SYN packet at the same moment that the TCP connection is established in another thread, causing the first thread to access the connection's options structure after the second thread has freed it.…
On October 27, Anthropic disclosed a remotely exploitable use-after-free bug in Linux systems that have multipath TCP listeners enabled. The vulnerability arises when a response to a retransmitted SYN packet is received simultaneously as the TCP connection is being established in another thread. This leads to the first thread accessing the connection's options structure after it has been freed by the second thread.
As a result, the first thread can expose kernel memory or cause a buffer overflow, writing an attacker-controlled payload.
The issue is resolved by ensuring the structure is only freed after an RCU grace period. On October 29, the Go security team recommended that all Go programs utilize multipath TCP by default, potentially leaving many systems unknowingly vulnerable. There is also the possibility of related bugs in other areas of the TCP stack.
Users are advised to update to a patched kernel as soon as one is available for their distribution.
Written by urgent.news from LWN's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
