[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140627111545.GU19028@dhcp-25-225.brq.redhat.com>
Date: Fri, 27 Jun 2014 13:15:45 +0200
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request -- Linux kernel: sctp: sk_ack_backlog wrap-around problem
Description of the problem:
For a TCP-style socket, while processing the COOKIE_ECHO chunk in
sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a
new association would be created in sctp_unpack_cookie(), but
afterwards, some processing maybe failed, and sctp_association_free()
will be called to free the previously allocated association, in
sctp_association_free(), sk_ack_backlog value is decremented for this
socket, since the initial value for sk_ack_backlog is 0, after
the decrement, it will be 65535, a wrap-around problem happens, and
if we want to establish new associations afterward in the same
socket, ABORT would be triggered since sctp deem the accept queue as
full.
A remote attacker can block further connection to the particular sctp
server socket by sending a specially crafted sctp packet.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d3217b15a19a4779c39b212358a5c71d725822ee
References:
https://bugzilla.redhat.com/show_bug.cgi?id=1113967
Thanks,
--
Petr Matousek / Red Hat Product Security
PGP: 0xC44977CA 8107 AF16 A416 F9AF 18F3 D874 3E78 6F42 C449 77CA
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
