CVE-2024-41007 Information

Description

In the Linux kernel the following vulnerability has been resolved:

tcp: avoid too many retransmit packets

If a TCP socket is using TCP_USER_TIMEOUT and the other peer retracted its window to zero tcp_retransmit_timer() can retransmit a packet every two jiffies (2 ms for HZ=1000) for about 4 minutes after TCP_USER_TIMEOUT has ’expired'.

The fix is to make sure tcp_rtx_probe0_timed_out() takes icsk->icsk_user_timeout into account.

Before blamed commit the socket would not timeout after icsk->icsk_user_timeout but would use standard exponential backoff for the retransmits.

Also worth noting that before commit e89688e3e978 ( et: tcp: fix unexcepted socket die when snd_wnd is 0) the issue would last 2 minutes instead of 4.

Reference

https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283