In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: drop a chunk if its transport was removed<\/p>\n
sctp_rcv() resolves the transport once per packet and leaves it in
\nchunk->transport. The lookup reference, or the one sctp_add_backlog() takes
\nif the socket is owned by userspace, keeps it around until the chunk has
\nbeen processed.<\/p>\n
An authenticated ASCONF DEL-IP can remove it in the meantime.
\nsctp_assoc_rm_peer() takes the transport out of the association and calls
\nsctp_transport_free(), which tags it dead and drops the reference the
\nassociation held. There is a window on both paths: the packet can sit on
\nthe socket backlog, and on the direct path the lookup completes before
\nbh_lock_sock().<\/p>\n
The DATA chunk in that packet puts the removed transport back into
\nasoc->peer.last_data_from. Once the packet is done that reference goes
\naway and the transport is freed by RCU, so the next delayed SACK carries
\nthe pointer into the SACK chunk and sctp_outq_select_transport() reads the
\nfreed transport’s state.<\/p>\n
Drop the chunk in sctp_inq_push(), next to the existing rcvr->dead check.
\nBoth paths reach it with the association’s socket lock held. The peer
\nretransmits it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: drop a chunk if its transport was removed<\/p>\n
sctp_rcv() resolves the transport once per packet and leaves it in
\nchunk->transpor<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21400","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}