In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: clear new_transport when removing a peer<\/p>\n
sctp_process_asconf_param() stores a newly added peer transport in
\nasoc->new_transport. After all parameters in the ASCONF chunk have been
\nprocessed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the
\nnew transport.<\/p>\n
An authenticated ASCONF from a remote SCTP peer can add a transport and
\nremove it again with a wildcard DEL-IP parameter in the same chunk. The
\nwildcard deletion preserves the transport on which the ASCONF arrived, but
\nremoves the newly added transport through
\nsctp_assoc_del_nonprimary_peers(). The removal does not clear
\nasoc->new_transport, leaving it pointing to the removed transport.<\/p>\n
sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points
\nto the removed transport without holding a transport reference. During
\nlocal address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on
\ncontrol_chunk_list. After the transport is freed by RCU, a successful
\nASCONF_ACK for the replacement address releases the queued HEARTBEAT and
\nsctp_outq_select_transport() reads the freed transport’s state.<\/p>\n
The issue was found during a static audit of SCTP objects. With an
\nauthenticated peer, the reproducer triggered the same KASAN report in 2
\nof 2 unpatched runs on a KASAN-enabled netdev\/main kernel:<\/p>\n
BUG: KASAN: slab-use-after-free in sctp_outq_select_transport
\n Read of size 4 at addr ffff88800b9bd95c by task python3\/197<\/p>\n
Call Trace:
\n sctp_outq_select_transport+0x549\/0x8b0 [sctp]
\n sctp_outq_flush+0x306\/0x2c60 [sctp]
\n sctp_transport_immediate_rtx+0xaf\/0x260 [sctp]
\n sctp_process_asconf_ack+0xa48\/0xf70 [sctp]<\/p>\n
Allocated by task 197:
\n sctp_transport_new+0x68\/0x650 [sctp]
\n sctp_assoc_add_peer+0x258\/0x12a0 [sctp]
\n sctp_process_asconf+0x5e9\/0x1090 [sctp]<\/p>\n
Last potentially related work creation:
\n __call_rcu_common.constprop.0+0x77\/0xb70
\n sctp_assoc_del_nonprimary_peers+0x7c\/0xd0 [sctp]
\n sctp_process_asconf+0xd9c\/0x1090 [sctp]<\/p>\n
The first invalid access was a four-byte read of transport->state at
\nnet\/sctp\/outqueue.c:833. The same reproducer completed the full
\nauthenticated ASCONF and local-address replacement sequence with this
\nchange without a KASAN report or oops.<\/p>\n
Clear new_transport when its peer is removed, before it can be used to
\ncreate the HEARTBEAT.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: clear new_transport when removing a peer<\/p>\n
sctp_process_asconf_param() stores a newly added peer transport in
\nasoc->new_transp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11197","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}