oss-sec mailing list archives
CVE request -- Linux kernel: sctp: sk_ack_backlog wrap-around problem
From: Petr Matousek <pmatouse () redhat com>
Date: Fri, 27 Jun 2014 13:15:45 +0200
Description of the problem: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. A remote attacker can block further connection to the particular sctp server socket by sending a specially crafted sctp packet. Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d3217b15a19a4779c39b212358a5c71d725822ee References: https://bugzilla.redhat.com/show_bug.cgi?id=1113967 Thanks, -- Petr Matousek / Red Hat Product Security PGP: 0xC44977CA 8107 AF16 A416 F9AF 18F3 D874 3E78 6F42 C449 77CA
Current thread:
- CVE request -- Linux kernel: sctp: sk_ack_backlog wrap-around problem Petr Matousek (Jun 27)
- Re: CVE request -- Linux kernel: sctp: sk_ack_backlog wrap-around problem cve-assign (Jun 27)