Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2024-57938

net/sctp: Prevent autoclose integer overflow in sctp_association_init()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to < 94b7ed0a4896420988e1776942f0a3f67167873eaffected
  • 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to < 081bdb3a31674339313c6d702af922bc29de2c53affected
  • 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to < f9c3adb083d3278f065a83c3f667f1246c74c31faffected
  • 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to < 7af63ef5fe4d480064eb22583b24ffc8b408183aaffected
  • 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to < 271f031f4c31c07e2a85a1ba2b4c8e734909a477affected
  • 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to < 2297890b778b0e7c8200d6818154f7e461d78e94affected
  • 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to < 4e86729d1ff329815a6e8a920cb554a1d4cb5b8daffected

Linux Linux

Default version status: affected

  • 3.13affected
  • 0 to < 3.13unaffected
  • 5.4.289 to ≤ 5.4.*unaffected
  • 5.10.233 to ≤ 5.10.*unaffected
  • 5.15.176 to ≤ 5.15.*unaffected
  • 6.1.124 to ≤ 6.1.*unaffected
  • 6.6.70 to ≤ 6.6.*unaffected
  • 6.12.9 to ≤ 6.12.*unaffected
  • 6.13 to ≤ *unaffected

References