oss-sec mailing list archives

CVE request: kernel: sctp: memory overflow when FWD-TSN chunk is received with bad stream ID


From: "Eugene Teo" <eugeneteo () kernel sg>
Date: Mon, 5 Jan 2009 14:15:56 +0800

This was fixed in upstream kernel recently. Can you please assign a CVE name?

"If FWD-TSN chunk is received with bad stream ID, the sctp will not do
the validity check, this may cause memory overflow when overwrite the
TSN of the stream ID."

Analysis:
https://bugzilla.redhat.com/show_bug.cgi?id=478800#c3

References:
http://patchwork.ozlabs.org/patch/15024/
https://bugzilla.redhat.com/show_bug.cgi?id=478800

Upstream commit:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9fcb95a105758b81ef0131cd18e2db5149f13e95

Thanks, Eugene


Current thread: