CVE-2024-41007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-41007
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41007.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-41007
Downstream
Related
Published
2024-07-15T08:48:10.174Z
Modified
2026-05-28T03:53:17.559193936Z
Summary
tcp: avoid too many retransmit packets
Details

In the Linux kernel, the following vulnerability has been resolved:

tcp: avoid too many retransmit packets

If a TCP socket is using TCPUSERTIMEOUT, and the other peer retracted its window to zero, tcpretransmittimer() can retransmit a packet every two jiffies (2 ms for HZ=1000), for about 4 minutes after TCPUSERTIMEOUT has 'expired'.

The fix is to make sure tcprtxprobe0timedout() takes icsk->icskusertimeout into account.

Before blamed commit, the socket would not timeout after icsk->icskusertimeout, but would use standard exponential backoff for the retransmits.

Also worth noting that before commit e89688e3e978 ("net: tcp: fix unexcepted socket die when snd_wnd is 0"), the issue would last 2 minutes instead of 4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41007.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b701a99e431db784714c32fc6b68123045714679
Fixed
7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4
Fixed
d2346fca5bed130dc712f276ac63450201d52969
Fixed
5d7e64d70a11d988553a08239c810a658e841982
Fixed
04317a2471c2f637b4c49cbd0e9c0d04a519f570
Fixed
e113cddefa27bbf5a79f72387b8fbd432a61a466
Fixed
dfcdd7f89e401d2c6616be90c76c2fac3fa98fde
Fixed
66cb64a1d2239cd0309f9b5038b05462570a5be1
Fixed
97a9063518f198ec0adb2ecb89789de342bb8283

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41007.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.19.0
Fixed
4.19.318
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.280
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.222
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.163
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.100
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.41
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.10

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41007.json"