In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: fix NULL deref on untransmitted RECONF completion<\/p>\n
sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and
\nsctp_process_strreset_resp() complete a pending stream reconfiguration
\nrequest by stopping the reconf timer on the transport it was sent on:<\/p>\n
\tt = asoc->strreset_chunk->transport;
\n\tif (timer_delete(&t->reconf_timer))
\n\t\tsctp_transport_put(t);<\/p>\n
chunk->transport is assigned by __sctp_packet_append_chunk() when the
\nchunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms
\nthe reconf timer at that same point. A request already published in
\nasoc->strreset_chunk but not yet transmitted has neither, so completing
\nit dereferences NULL.<\/p>\n
Two ways to get there. sctp_send_asconf_del_ip() sets
\nasoc->src_out_of_asoc_ok without sending anything when the address being
\nremoved is the association’s last one, and sctp_outq_flush_ctrl() then
\nleaves every non-ASCONF control chunk queued; as only
\nsctp_process_asconf_ack() clears that flag, it persists. An unprivileged
\nprocess that removes such an address and then asks for a stream reset
\npanics the kernel from softirq. A peer needs neither ASCONF nor local
\nhelp: sctp_cmd_interpreter() uncorks the outqueue only once the whole
\npacket has been processed, so a reply built while walking a RECONF chunk
\nstays untransmitted for the rest of that walk, and one RECONF chunk
\ncarrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,
\nResponse] — or two RECONF chunks in one packet — reaches the same
\ndereference.<\/p>\n
KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]
\n RIP: 0010:timer_delete+0x67\/0x110
\n Call Trace:<\/p>\n
sctp_process_strreset_addstrm_out (net\/sctp\/stream.c:832)
\n sctp_sf_do_reconf (net\/sctp\/sm_statefuns.c:4212)
\n sctp_do_sm (net\/sctp\/sm_sideeffect.c:1172)
\n sctp_assoc_bh_rcv (net\/sctp\/associola.c:1044)
\n sctp_rcv (net\/sctp\/input.c:243)
\n ip_local_deliver (net\/ipv4\/ip_input.c:262)
\n process_backlog (net\/core\/dev.c:6680)<\/p>\n
A response can only acknowledge a request that was actually sent, so do
\nnot match asoc->strreset_chunk while chunk->transport is NULL. Guarding
\nthe lookup covers all three completion sites.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: fix NULL deref on untransmitted RECONF completion<\/p>\n
sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and
\nsc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21399","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}