oss-security - Re: CVE request: kernel: sctp: Fix kernel panic while process protocol violation parameter

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <48FD3C21.9050507@redhat.com>
Date: Tue, 21 Oct 2008 10:19:13 +0800
From: Eugene Teo <eteo@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: kernel: sctp: Fix kernel panic while
 process protocol violation parameter

Eugene Teo wrote:
> Eugene Teo wrote:
>> This was committed in upstream kernel recently.
>>
>> "[PATCH] sctp: Fix kernel panic while process protocol violation parameter
>>
>> Since call to function sctp_sf_abort_violation() need paramter 'arg'
>> with 'struct sctp_chunk' type, it will read the chunk type and chunk
>> length from the chunk_hdr member of chunk. But call to
>> sctp_sf_violation_paramlen() always with 'struct sctp_paramhdr' type's
>> parameter, it will be passed to sctp_sf_abort_violation(). This may
>> cause kernel panic."
>>
>> Upstream commit: ba0166708ef4da7eeb61dd92bbba4d5a749d6561
>>
>> This is user-triggerable.
> 
> Ping Steve. This needs a CVE name too. Thanks!

My bad. Steve assigned this with CVE-2008-4618.

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.