Description
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a kernel
Fixed in linux kernel v5.15 and aboveaffected
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2000694 ↗
- https://ubuntu.com/security/CVE-2021-3772 ↗
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df ↗
- https://github.com/torvalds/linux/commit/32f8807a48ae55be0e76880cfe8607a18b5bb0df ↗
- https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html ↗
- https://www.debian.org/security/2022/dsa-5096 ↗
- https://www.oracle.com/security-alerts/cpujul2022.html ↗
- https://security.netapp.com/advisory/ntap-20221007-0001/ ↗