[FIPS 9.2] mptcp CVEs {CVE-2024-57882,CVE-2024-53122} + bugfix

[PlaidCat]

Context this has 2 CVES and a bug fix to the same commit as CVE-2024-57882

Despite MPTCP (MultiPath TCP) is disabled by default we do know that some customers use MultiPath in various ways and can be incredibly difficult to trouble shoot so we're address some additional CVEs outside our priority matrix to make this a little bit better.

Commit Merge Conflicts

a562bf3
A recent change f410cbe introduced in v6.10-rc1 tcp annotate data-races around tp->window_clamp had some fuzz due to the WRITE_ONCE and keep the original code. No conflicts in merged in code.

BUILD

Note I rebased this to be off the current HEAD after build and test was done.

/mnt/code/kernel-src-tree-build
no .config file found, moving on
[TIMER]{MRPROPER}: 0s
x86_64 architecture detected, copying config
'configs/kernel-5.14.0-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241"
Making olddefconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  HOSTCC  scripts/kconfig/confdata.o
  HOSTCC  scripts/kconfig/expr.o
  LEX     scripts/kconfig/lexer.lex.c
  YACC    scripts/kconfig/parser.tab.[ch]
  HOSTCC  scripts/kconfig/lexer.lex.o
  HOSTCC  scripts/kconfig/menu.o
  HOSTCC  scripts/kconfig/parser.tab.o
  HOSTCC  scripts/kconfig/preprocess.o
  HOSTCC  scripts/kconfig/symbol.o
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h

[SNIP]

  BTF [M] virt/lib/irqbypass.ko
  BTF [M] sound/xen/snd_xen_front.ko
[TIMER]{BUILD}: 1348s
Making Modules
  INSTALL /lib/modules/5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+/kernel/arch/x86/crypto/blake2s-x86_64.ko
  STRIP   /lib/modules/5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+/kernel/arch/x86/crypto/blake2s-x86_64.ko
  
[SNIP]

  STRIP   /lib/modules/5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+/kernel/virt/lib/irqbypass.ko
  DEPMOD  /lib/modules/5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+
[TIMER]{MODULES}: 38s
Making Install
sh ./arch/x86/boot/install.sh \
        5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+ arch/x86/boot/bzImage \
        System.map "/boot"
[TIMER]{INSTALL}: 21s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+ and Index to 0
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 1348s
[TIMER]{MODULES}: 38s
[TIMER]{INSTALL}: 21s
[TIMER]{TOTAL} 1411s
Rebooting in 10 seconds

kABI Check

Checking kABI
kABI check passed

Kernel Self Tests

[jmaple@devbox code]$ grep '^ok ' kernel_5.14.0-284.30.1.el9_2.ciqfips.0.9.1.x86_64_iteration_1_nocomments.log | wc -l && grep '^ok ' kernel_5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+_iteration_1_nocomments.log | wc -l
205
207
[jmaple@devbox code]$ grep '^not ok '  kernel_5.14.0-284.30.1.el9_2.ciqfips.0.9.1.x86_64_iteration_1_nocomments.log | wc -l && grep '^not ok ' kernel_5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+_iteration_1_nocomments.log | wc -l
18
16

kernel_5.14.0-284.30.1.el9_2.ciqfips.0.9.1.x86_64_iteration_1_nocomments.log
kernel_5.14.0-_jmaple__fips-9-compliant_5.14.0-284.30.1-9165dab32241+_iteration_2_nocomments.log

[bmastbergen]

LGTM 🥌

[thefossguy-ciq]

Note: The final line in our cherry-pick of eea9934 doesn't match with upstream. But it doesn't affect the actual CVE fix. Hence approved.

🚢

[PlaidCat]

Note: The final line in our cherry-pick of eea9934 doesn't match with upstream. But it doesn't affect the actual CVE fix. Hence approved.

🚢

See the Commit Merge Conflicts section, this is actually the same CVE as here: #175 where we discussed if the contextual information from a merge conflict (due to contextual fuzz) that doesn't impact the ingested code is worth mentioning in the commit message or the PR.

[PlaidCat]

I will be holding this till next week. I haven't been as active on the CVE remediation I did a process we used to do a year ago which was use a tool scan_for_fixes that should also let us know about other related bug-fixes. I thought I was running wrong because or running out of date to more recent changes to the structure of the kernel-src-tree.

I thought it was supposed to find other Fixes: <short sha> to the same fix, but its actually to find to find Fixes: <sha> for commit <sha>, ie looking for Fixes: <cve sha> of the cve that we just integrated.

For CVE-2024-53122 Fixes: c76c6956566f ("mptcp: call tcp_cleanup_rbuf on subflows")

So we have all the Fixes: <sha> related to the original sha the CVE fixes.

[jmaple@devbox kernel-src-tree]$ git branch --show-current && git log --grep "Fixes: c76c695" --oneline
kernel-mainline
ce7356ae3594 mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
717f20341686 mptcp: don't skip needed ack

[jmaple@devbox kernel-src-tree]$ git branch --show-current && git log --grep "Fixes: c76c695" --oneline {jmaple}_fips-9-compliant/5.14.0-284.30.1
kernel-mainline
a562bf3d8b93 (origin/{jmaple}_fips-9-compliant/5.14.0-284.30.1, {jmaple}_fips-9-compliant/5.14.0-284.30.1) mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
717f20341686 mptcp: don't skip needed ack

Using the above shas on mainline there are no Fixes to the Fixes of Fixes: c76c6956566f ("mptcp: call tcp_cleanup_rbuf on subflows"

[jmaple@devbox kernel-src-tree]$ git branch --show-current && git log --grep "Fixes: ce7356a" --oneline
kernel-mainline
[jmaple@devbox kernel-src-tree]$ git branch --show-current && git log --grep "Fixes: 717f203" --oneline
kernel-mainline

For CVE CVE-2024-57882 Fixes: 1bff1e ("mptcp: optimize out option generation")

[jmaple@devbox kernel-src-tree]$ git branch --show-current && git log --grep "Fixes: 1bff1e4" --oneline
kernel-mainline
2c1f97a52cb8 mptcp: Fix data stream corruption in the address announcement
cbb26f7d8451 mptcp: fix TCP options overflow.
110b6d1fe98f mptcp: fix a DSS option writing error
[jmaple@devbox kernel-src-tree]$ git branch --show-current && git log --grep "Fixes: 1bff1e4" --oneline {jmaple}_fips-9-compliant/5.14.0-284.30.1
kernel-mainline
eea9934f82bd mptcp: Fix data stream corruption in the address announcement
c76e2ca33c91 mptcp: fix TCP options overflow.
c7f09474e96e mptcp: fix a DSS option writing error

IF we actually check the CVE fix sha there are no pending fixes for it cbb26f7d8451 mptcp: fix TCP options overflow.

[jmaple@devbox kernel-src-tree]$ git branch --show-current && git log --grep "Fixes: cbb26f7" --oneline
kernel-mainline
[jmaple@devbox kernel-src-tree]$ git branch --show-current && git log --grep "Fixes: 110b6d1" --oneline
kernel-mainline

So it appears that scan_for_fixes worked (I think) but I was expecting something else and would be worth making sure that this works as expected and add it to our list of things to auto run as a part of PR checks.
I will look into this and discuss with others in leadership, especially security if we want to be bringing in Fixes: to just CVE shas we're importing or include fixes for the original sha that the cve is fixing.

[PlaidCat]

Discussed it with others and we're going to move forward with the bugfix that addresses the same original caommit that CVE-2024-57882 addresses with further updates.