oss-security - CVE request: kernel: sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <48EC2EA6.4020003@redhat.com>
Date: Wed, 08 Oct 2008 11:53:10 +0800
From: Eugene Teo <eteo@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: sctp: Fix oops when INIT-ACK indicates that
 peer doesn't support AUTH

This was committed in upstream kernel recently.

"[PATCH] sctp: Fix oops when INIT-ACK indicates that peer doesn't
support AUTH

If INIT-ACK is received with SupportedExtensions parameter which
indicates that the peer does not support AUTH, the packet will be
silently ignore, and sctp_process_init() do cleanup all of the
transports in the association. When T1-Init timer is expires, OOPS
happen while we try to choose a different init transport.

The solution is to only clean up the non-active transports, i.e
the ones that the peer added.  However, that introduces a problem
with sctp_connectx(), because we don't mark the proper state for
the transports provided by the user.  So, we'll simply mark
user-provided transports as ACTIVE.  That will allow INIT
retransmissions to work properly in the sctp_connectx() context
and prevent the crash."

Upstream commit: add52379dde2e5300e2d574b172e62c6cf43b3d3

This can be triggered if the SCTP connection between both ends have
mis-matched settings, i.e. one end with AUTH extensions enabled, and the
other end with AUTH extension disabled. This requires a CVE name.

Thanks, Eugene
--
Eugene Teo / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.