{"id":"DEBIAN-CVE-2024-37356","details":"In the Linux kernel, the following vulnerability has been resolved:  tcp: Fix shift-out-of-bounds in dctcp_update_alpha().  In dctcp_update_alpha(), we use a module parameter dctcp_shift_g as follows:    alpha -= min_not_zero(alpha, alpha \u003e\u003e dctcp_shift_g);   ...   delivered_ce \u003c\u003c= (10 - dctcp_shift_g);  It seems syzkaller started fuzzing module parameters and triggered shift-out-of-bounds [0] by setting 100 to dctcp_shift_g:    memcpy((void*)0x20000080,          \"/sys/module/tcp_dctcp/parameters/dctcp_shift_g\\000\", 47);   res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul,                 /*flags=*/2ul, /*mode=*/0ul);   memcpy((void*)0x20000000, \"100\\000\", 4);   syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul);  Let's limit the max value of dctcp_shift_g by param_set_uint_minmax().  With this patch:    # echo 10 \u003e /sys/module/tcp_dctcp/parameters/dctcp_shift_g   # cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g   10   # echo 11 \u003e /sys/module/tcp_dctcp/parameters/dctcp_shift_g   -bash: echo: write error: Invalid argument  [0]: UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12 shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace:  \u003cTASK\u003e  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114  ubsan_epilogue lib/ubsan.c:231 [inline]  __ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468  dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143  tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline]  tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948  tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711  tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937  sk_backlog_rcv include/net/sock.h:1106 [inline]  __release_sock+0x20f/0x350 net/core/sock.c:2983  release_sock+0x61/0x1f0 net/core/sock.c:3549  mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907  mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976  __mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072  mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127  inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437  __sock_release net/socket.c:659 [inline]  sock_close+0xc0/0x240 net/socket.c:1421  __fput+0x41b/0x890 fs/file_table.c:422  task_work_run+0x23b/0x300 kernel/task_work.c:180  exit_task_work include/linux/task_work.h:38 [inline]  do_exit+0x9c8/0x2540 kernel/exit.c:878  do_group_exit+0x201/0x2b0 kernel/exit.c:1027  __do_sys_exit_group kernel/exit.c:1038 [inline]  __se_sys_exit_group kernel/exit.c:1036 [inline]  __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f6c2b5005b6 Code: Unable to access opcode bytes at 0x7f6c2b50058c. RSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6 RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001 RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0 R10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001  \u003c/TASK\u003e","modified":"2026-09-15T09:03:08.577967824Z","published":"2024-06-21T11:15:10.677Z","upstream":["CVE-2024-37356"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-37356"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.94-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-37356.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-37356.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-37356.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}