In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration<\/p>\n
sctp_verify_asconf() walks ASCONF-ACK parameters with
\nsctp_walk_params(), which advances by SCTP_PAD4(length), while the
\nconsumer sctp_get_asconf_response() iterates the same parameters
\nadvancing by the raw length, without padding. A single odd-length
\nparameter desynchronises the two walks and makes the consumer
\ninterpret attacker-controlled bytes at a misaligned offset.<\/p>\n
When those bytes yield a length of zero, the while loop over
\nasconf_ack_len makes no progress, spinning forever in softirq
\ncontext, and the watchdog reports a soft lockup. All reads stay
\nwithin the received skb, so the lockup is a pure remote denial of
\nservice. A remote peer can trigger it with a crafted ASCONF-ACK on
\nan ADD-IP enabled association with an outstanding ASCONF (RFC 5061
\nsection 4.1.2 requires the chunk to be authenticated, but the
\npredefined empty key id 0 allows the peer to compute the same
\nassociation HMAC from publicly exchanged parameters, so the gate
\ndoes not help).<\/p>\n
The SCTP_PARAM_ERR_CAUSE case of sctp_verify_asconf() also performs
\nno length check, letting a parameter without a complete error
\nheader reach the consumer, which reads errhdr.cause past the end of
\nthe parameter, an out-of-bounds read.<\/p>\n
Reject SCTP_PARAM_ERR_CAUSE parameters shorter than
\nsizeof(struct sctp_addip_param) + sizeof(struct sctp_errhdr) at the
\nverifier, and advance the consumer iterator with the same padding
\nrule as the verifier to keep the two walks in lockstep. The verifier
\nchange guarantees a complete error header in every ERR_CAUSE
\nparameter the consumer can see, so the consumer’s asconf_ack_len
\ncheck is dropped and it returns err_param->cause directly. The
\nconsumer padding fix is still required because odd lengths remain
\nvalid for SCTP_PARAM_ERR_CAUSE per RFC 5061.<\/p>\n
The issue was found by ZeroHive, a vulnerability hunting agent at
\nTencent Yunding Lab.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration<\/p>\n
sctp_verify_asconf() walks ASCONF-ACK parameters with
\nsctp_walk<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29277","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}