oss-security - CVE request: kernel: sctp: Fix kernel panic while process protocol violation parameter

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <48E9BB33.3010903@redhat.com>
Date: Mon, 06 Oct 2008 15:16:03 +0800
From: Eugene Teo <eteo@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: sctp: Fix kernel panic while process protocol
 violation parameter

This was committed in upstream kernel recently.

"[PATCH] sctp: Fix kernel panic while process protocol violation parameter

Since call to function sctp_sf_abort_violation() need paramter 'arg'
with 'struct sctp_chunk' type, it will read the chunk type and chunk
length from the chunk_hdr member of chunk. But call to
sctp_sf_violation_paramlen() always with 'struct sctp_paramhdr' type's
parameter, it will be passed to sctp_sf_abort_violation(). This may
cause kernel panic."

Upstream commit: ba0166708ef4da7eeb61dd92bbba4d5a749d6561

This is user-triggerable.

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.