In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: auth: verify auth requirement when auth_chunk is NULL<\/p>\n
sctp_auth_chunk_verify() returns true unconditionally when
\nchunk->auth_chunk is NULL, silently skipping authentication.
\nThis is incorrect when:<\/p>\n
1. skb_clone() failed in the BH receive path, leaving auth_chunk
\n NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new
\n connections, so the early sctp_auth_recv_cid() check cannot
\n catch this.<\/p>\n
2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never
\n called and auth_chunk remains NULL.<\/p>\n
Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL:
\nif authentication is required, return false to drop the chunk;
\notherwise continue normally.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: auth: verify auth requirement when auth_chunk is NULL<\/p>\n
sctp_auth_chunk_verify() returns true unconditionally when
\nchunk->auth<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5418","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}