Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option

["Steven M. Christey" <coley () linus mitre org>]

On Thu, 25 Sep 2008, Eugene Teo wrote:

> Hi Steve,
>
> The first three references to CVE-2008-4113[1] are incorrect. Please
> update the CVE with the following references:
>
> http://marc.info/?l=linux-sctp&m=121986743009093&w=2
> http://marc.info/?l=linux-sctp&m=121986743209110&w=2
>
> [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4113

This was in reference to the TKADV2008-007 advisory.

I guess the question becomes - TKADV2008-007 talks about separate issues,
one involving crashes by calling the API functions when SCTP-AUTH is
disabled (CVE-2008-3792), and another involving SCTP_HMAC_IDENT and a
length value for sctp_getsockopt_hmac_ident.

CVE-2008-4113 is anchored on what's specified in TKADV2008-007:

  The Linux Kernel contains an information disclosure vulnerability while
  parsing the IOCTL SCTP_HMAC_IDENT...

  if (get_user(len, optlen)) <-- [1]

   ...

  retval = sctp_getsockopt_hmac_ident(sk, len, optval, optlen); <-- [2]


which seems different from this one:

  http://marc.info/?l=linux-sctp&m=121986743209110&w=2

  "The number of identifiers needs to be checked against the option
   length.  Also, the identifier index provided needs to be verified
   to make sure that it doesn't exceed the bounds of the array."

and this one:

  http://marc.info/?l=linux-sctp&m=121988176932559&w=2

  The bonds check to prevent buffer overlflow was not exactly
  right.  It still allowed overflow of up to 8 bytes which is
  sizeof(struct sctp_authkey)."


So Eugene, it sounds like the issues that you found were variants of the
issue reported for the sctp_getsockopt_hmac_ident (a different function)
by TKADV2008-007 for CVE-2008-4113.

Do we need new CVE identifiers?  Or am I missing something?

- Steve