In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: validate stream count in sctp_process_strreset_inreq()<\/p>\n
When processing a RESET_IN_REQUEST from a peer,
\nsctp_process_strreset_inreq() derives the stream count from the
\nparameter length but does not check whether the resulting
\nRESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.<\/p>\n
The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes
\nlarger than the IN request header (sctp_strreset_inreq, 8 bytes).
\nGenerally, the IP payload is bounded to 65535 bytes, so the stream
\nlist cannot be large enough to trigger the overflow. However, on
\ninterfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a
\nstream list that fits within the incoming IN parameter can cause a
\n__u16 overflow in sctp_make_strreset_req() when computing the OUT
\nrequest size, leading to an undersized skb allocation and a kernel
\nBUG:<\/p>\n
net\/core\/skbuff.c:207 skb_panic
\n net\/core\/skbuff.c:2625 skb_put
\n net\/sctp\/sm_make_chunk.c:1535 sctp_addto_chunk
\n net\/sctp\/sm_make_chunk.c:3695 sctp_make_strreset_req
\n net\/sctp\/stream.c:655 sctp_process_strreset_inreq<\/p>\n
The local setsockopt path validates the generated reset request size.
\nHowever, for an incoming-only reset, it accounts for the smaller IN
\nrequest even though the peer must generate an OUT request with the same
\nstream list. Such a request cannot be completed successfully by the
\npeer.<\/p>\n
Reject peer IN requests whose corresponding OUT request would exceed
\nSCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an
\nIN request that would require an oversized OUT request from the peer.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sctp: validate stream count in sctp_process_strreset_inreq()<\/p>\n
When processing a RESET_IN_REQUEST from a peer,
\nsctp_process_strreset<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5422","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5422","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5422"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5422"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5422"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}