SCTP Out-of-Bounds Read in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. Specifically, when a listening SCTP server processes a COOKIE_ECHO chunk, it parses a cached peer INIT chunk embedded after the cookie. The vulnerability arises because the length of this cached INIT chunk was not properly validated against the remaining buffer size in the COOKIE_ECHO payload.

If the length field of the cached INIT chunk is artificially inflated, the subsequent parameter processing can read beyond the actual received data. This can lead to out-of-bounds reads and potential memory corruption during later handling steps, such as STATE_COOKIE processing and memory duplication operations.

The fix involved adding a bounds check in the sctp_unpack_cookie() function to ensure that the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads and potential memory corruption within the Linux kernel's SCTP processing. Such memory corruption can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service on affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by adding a bounds check in the Linux kernel SCTP implementation to validate the cached INIT chunk length during COOKIE_ECHO processing.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Until the update is applied, consider limiting or blocking SCTP traffic if it is not required in your environment to reduce exposure.

Useful 0 Not Useful 0