Description
In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_strreset_inreq() When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count from the parameter length but does not check whether the resulting RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN. The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes larger than the IN request header (sctp_strreset_inreq, 8 bytes). Generally, the IP payload is bounded to 65535 bytes, so the stream list cannot be large enough to trigger the overflow. However, on interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a stream list that fits within the incoming IN parameter can cause a __u16 overflow in sctp_make_strreset_req() when computing the OUT request size, leading to an undersized skb allocation and a kernel BUG: net/core/skbuff.c:207 skb_panic net/core/skbuff.c:2625 skb_put net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req net/sctp/stream.c:655 sctp_process_strreset_inreq The local setsockopt path validates the generated reset request size. However, for an incoming-only reset, it accounts for the smaller IN request even though the peer must generate an OUT request with the same stream list. Such a request cannot be completed successfully by the peer. Reject peer IN requests whose corresponding OUT request would exceed SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an IN request that would require an oversized OUT request from the peer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 to < 61327d8e7cfb0259d527be17202630f556213249affected7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 to < 7cf7439948e3bf639119119922c88ec190874ca3affected7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 to < 60c47dea5d320d2fc706e9aad1db38a04df0a056affected7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 to < b255d8cd6cc68045ae9eecbac3b3c14e1f176c9baffected7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 to < 6f0e39d180cd7cced647381b6fa14fd83d261047affected7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 to < 1a10fe1aa9c01f41b389a31906a77d538637c9d9affected7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 to < 00ae679cb21a035491fdad8d58dc6d79cc68b675affected7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 to < 18ae07691d43183d270de8be9dc8e027906015d9affected
Linux Linux
Default version status: affected
4.11affected0 to < 4.11unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/61327d8e7cfb0259d527be17202630f556213249 ↗
- https://git.kernel.org/stable/c/7cf7439948e3bf639119119922c88ec190874ca3 ↗
- https://git.kernel.org/stable/c/60c47dea5d320d2fc706e9aad1db38a04df0a056 ↗
- https://git.kernel.org/stable/c/b255d8cd6cc68045ae9eecbac3b3c14e1f176c9b ↗
- https://git.kernel.org/stable/c/6f0e39d180cd7cced647381b6fa14fd83d261047 ↗
- https://git.kernel.org/stable/c/1a10fe1aa9c01f41b389a31906a77d538637c9d9 ↗
- https://git.kernel.org/stable/c/00ae679cb21a035491fdad8d58dc6d79cc68b675 ↗
- https://git.kernel.org/stable/c/18ae07691d43183d270de8be9dc8e027906015d9 ↗