Description
In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent. The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association. Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f6e3cc296372accad4ee57405195021231ef4bcbaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c151daba0ceb1fb068a215b07de89fb1eb5f87bcaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 817cffdbdbdf50e1f2b016599d1897de3ca54964affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 61baa5020b0afb41bfd97f8f6ce5e336c4a4546eaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c68557a49e960dbcdede22c7a9b488603078b8b4affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < a0d1693923f41d6f49083aa2446686aed09d1d79affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 35c279113498d19a8734e2aae67b951b9b20f634affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f6e3cc296372accad4ee57405195021231ef4bcb ↗
- https://git.kernel.org/stable/c/c151daba0ceb1fb068a215b07de89fb1eb5f87bc ↗
- https://git.kernel.org/stable/c/817cffdbdbdf50e1f2b016599d1897de3ca54964 ↗
- https://git.kernel.org/stable/c/61baa5020b0afb41bfd97f8f6ce5e336c4a4546e ↗
- https://git.kernel.org/stable/c/c68557a49e960dbcdede22c7a9b488603078b8b4 ↗
- https://git.kernel.org/stable/c/a0d1693923f41d6f49083aa2446686aed09d1d79 ↗
- https://git.kernel.org/stable/c/35c279113498d19a8734e2aae67b951b9b20f634 ↗
- https://git.kernel.org/stable/c/9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 ↗