In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: fix use-after-free of cached ASCONF chunk<\/p>\n
addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal
\nASCONF-ACK completion path releases the chunk and clears the pointer.<\/p>\n
However, sctp_asconf_queue_teardown() releases the cached chunk without
\nclearing addip_last_asconf. During peer restart handling,
\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes
\nsctp_asconf_queue_teardown() while the association remains alive and leaves
\nthe pointer dangling.<\/p>\n
A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),
\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),
\ncausing a use-after-free and a second release.<\/p>\n
Clearing the pointer exposes a race with T4 expiry. Peer restart handling
\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses
\ntimer_delete(), which does not wait for a callback already running on
\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after
\nthe purge and dereference NULL.<\/p>\n
Clear addip_last_asconf after releasing the cached chunk, and make
\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding
\nASCONF remains.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: fix use-after-free of cached ASCONF chunk<\/p>\n
addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal
\nASCONF-<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11198","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}