Description
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8f840e47f190cbe61a96945c13e9551048d42cef to < b453e00da1211e997b82743d28af7714c59c05c8affected8f840e47f190cbe61a96945c13e9551048d42cef to < dfea32dd76f390e3155177b0038cc47b01386198affected8f840e47f190cbe61a96945c13e9551048d42cef to < 80f48523a0fe42db2e7375dff4e38a25c117090aaffected8f840e47f190cbe61a96945c13e9551048d42cef to < 546221b86ceeba0d8fec92d46a0604bb7b62be07affected8f840e47f190cbe61a96945c13e9551048d42cef to < 09e722030e8148ba4ed1e42c6b2ea57bda9f9895affected8f840e47f190cbe61a96945c13e9551048d42cef to < 4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0affected8f840e47f190cbe61a96945c13e9551048d42cef to < 6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75affected8f840e47f190cbe61a96945c13e9551048d42cef to < bd0e9289e2642f6a5c54faad304ce0f41e926d22affected
Linux Linux
Default version status: affected
4.7affected0 to < 4.7unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8 ↗
- https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198 ↗
- https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a ↗
- https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07 ↗
- https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895 ↗
- https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0 ↗
- https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75 ↗
- https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22 ↗