Описание
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
A flaw was found in the Linux kernel's implementation of the SCTP protocol. A remote attacker could trigger an out-of-bounds read with an offset of up to 64kB potentially causing the system to crash.
Отчет
This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5, 6, 7, MRG-2 and realtime and will be addressed in future updates.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Fixed | RHSA-2017:0307 | 23.02.2017 |
| Red Hat Enterprise Linux 7 | kernel-rt | Fixed | RHSA-2017:0091 | 17.01.2017 |
| Red Hat Enterprise Linux 7 | kernel | Fixed | RHSA-2017:0086 | 17.01.2017 |
| Red Hat Enterprise MRG 2 | kernel-rt | Fixed | RHSA-2017:0113 | 17.01.2017 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
7.1 High
CVSS2
Связанные уязвимости
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kern ...
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
ELSA-2016-3652: Unbreakable Enterprise kernel security update (IMPORTANT)
EPSS
5.9 Medium
CVSS3
7.1 High
CVSS2