Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1f485649f52929d9937b346a920a522a7363e202 to < 317731d01b03c529809df36d3a7d149677a8729daffected1f485649f52929d9937b346a920a522a7363e202 to < 0528485f27016a42804abe01aa61b39d85fa803eaffected1f485649f52929d9937b346a920a522a7363e202 to < ee5e65964f456adfe14d526fba0bd055de98ecf3affected1f485649f52929d9937b346a920a522a7363e202 to < 0b4414e43e0861d67276031cc21401d7e87de3daaffected1f485649f52929d9937b346a920a522a7363e202 to < d0a59ba58578e2b330fff80a44fe519f3ba7d8c7affected1f485649f52929d9937b346a920a522a7363e202 to < a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5dbaffected1f485649f52929d9937b346a920a522a7363e202 to < 3aa40c3bccac2312ea7cf97f329190637f972b5daffected1f485649f52929d9937b346a920a522a7363e202 to < e0b5252a59383b77d1b8dbeda00b7184dd95f4d3affected
Linux Linux
Default version status: affected
2.6.24affected0 to < 2.6.24unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d ↗
- https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e ↗
- https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3 ↗
- https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da ↗
- https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7 ↗
- https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db ↗
- https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d ↗
- https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3 ↗