Description
In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctp_assoc_update_retran_path() can loop forever when every remaining transport, including retran_path, is SCTP_UNCONFIRMED: the state check runs before the wraparound test, so the loop cannot observe that it has completed a full pass. Fix this by considering a transport only when it is not UNCONFIRMED, then checking whether the walk has returned to retran_path. This makes the full-pass termination independent of the transport state while preserving the existing fallback selection semantics. Also restore the NULL guard around the retran_path assignment. In the all-UNCONFIRMED case there is no eligible replacement transport, and installing NULL would leave later retransmit-path users and the debug print with a NULL path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 to < 3fe624c3843694ab096fdb198526ba0c659febbeaffected4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 to < 43410c1f2db53516e95ddd7e5b4b02f495b78121affected4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 to < d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49affected4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 to < 83b1a7f9e718828ef364a7b004254ebb2d0035feaffected4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 to < 173610fff55022a5ad1579fbcc7faa97467b58b7affected4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 to < c9338057df1025f578fe7d0ff08bada87b8b838daffected4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 to < ddc34cc0834c873871e88b055ee6a260676efe97affected4c47af4d5eb2c2f78f886079a3920a7078a6f0a0 to < d2c31b837406395e576afeb25958c98e9938f3f6affected8ceaec02b17397d12719a282945abc95f8149d9faffectedd2c2bdcdd8c5ce3d2a68aa3353ed1f340c3e500eaffected3.10.106 to < 3.11affected3.12.71 to < 3.13affected
Linux Linux
Default version status: affected
3.14affected0 to < 3.14unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3fe624c3843694ab096fdb198526ba0c659febbe ↗
- https://git.kernel.org/stable/c/43410c1f2db53516e95ddd7e5b4b02f495b78121 ↗
- https://git.kernel.org/stable/c/d893a7cc1cb41dd510f338bb2bfd8f29b14eaf49 ↗
- https://git.kernel.org/stable/c/83b1a7f9e718828ef364a7b004254ebb2d0035fe ↗
- https://git.kernel.org/stable/c/173610fff55022a5ad1579fbcc7faa97467b58b7 ↗
- https://git.kernel.org/stable/c/c9338057df1025f578fe7d0ff08bada87b8b838d ↗
- https://git.kernel.org/stable/c/ddc34cc0834c873871e88b055ee6a260676efe97 ↗
- https://git.kernel.org/stable/c/d2c31b837406395e576afeb25958c98e9938f3f6 ↗