Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD_OUT request again while another parameter is still outstanding, rolling back outcnt twice and possibly underflowing it. Track outstanding request types as bits and clear each bit after its first response. Later responses for the same request are then ignored.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 to < 041f7df5a929d3e7435dd8387e8ea17f2d412b7daffected11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 to < 59f61c39cb99ee1737bd742a20094fe5653389bbaffected11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 to < 793519e343867ee9a3e84f6cac07f81f2aec7b5daffected11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 to < 092acd3c55a4077b00489064615d8d2d898daf91affected11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 to < 2d867663c563e8009257b9edf9c8ec75d9bbf19aaffected11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 to < d02a5794c3deedcb8476d017fcee2b7aaedab2e1affected11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 to < 8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68affected11ae76e67a179f25ae8f772d62a7ddf717b1cdf3 to < 3faf13aff243ca9f78d08b1a2956ef5a6fc77b6eaffected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/041f7df5a929d3e7435dd8387e8ea17f2d412b7d ↗
- https://git.kernel.org/stable/c/59f61c39cb99ee1737bd742a20094fe5653389bb ↗
- https://git.kernel.org/stable/c/793519e343867ee9a3e84f6cac07f81f2aec7b5d ↗
- https://git.kernel.org/stable/c/092acd3c55a4077b00489064615d8d2d898daf91 ↗
- https://git.kernel.org/stable/c/2d867663c563e8009257b9edf9c8ec75d9bbf19a ↗
- https://git.kernel.org/stable/c/d02a5794c3deedcb8476d017fcee2b7aaedab2e1 ↗
- https://git.kernel.org/stable/c/8320cbd81bc21a1ca6ebdf70ad610ebc5ef1bd68 ↗
- https://git.kernel.org/stable/c/3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e ↗