Executive Summary

This vulnerability exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) diagnostic code. Specifically, the issue occurs in the exact sock_diag lookup process, where a transport reference can be held and the code can block on a socket lock. During this time, the SCTP association may be freed and marked dead, but the diagnostic functions may still try to access the now-invalid association state.

As a result, functions like inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as if it were a valid SCTP socket address entry, leading to an out-of-bounds read from unrelated memory. The fix involves rejecting associations that have been reaped or detached after taking the socket lock, thus preventing the diagnostic code from accessing stale or torn association state.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads in the Linux kernel when diagnostic information about SCTP associations is requested. Such out-of-bounds reads may cause system instability, crashes, or potentially expose sensitive kernel memory contents.

An attacker or diagnostic tool exploiting this flaw could cause denial of service or gain unintended access to kernel memory, which could be leveraged for further attacks or information disclosure.

Useful 0 Not Useful 0