oss-sec mailing list archives
CVE request: kernel: SCTP memory corruption in HMAC handling
From: Dan Rosenberg <dan.j.rosenberg () gmail com>
Date: Mon, 4 Oct 2010 09:21:55 -0400
Reference: http://marc.info/?l=linux-kernel&m=128596992418814&w=2 When parsing a peer's supported HMAC authentication options in the sctp_auth_asoc_get_hmac() function, a malicious peer can craft their HMAC array in such a way as to cause memory corruption (out-of-bounds read followed by use of retrieved out-of-bounds data), which at the very least could cause a denial of service via kernel panic, and possibly worse. It appears this could be triggered remotely when connecting to a malicious peer, or locally by a user acting as both endpoints. In both cases, the "auth_enable" sysctl must be set in order to trigger the bug. -Dan
Current thread:
- CVE request: kernel: SCTP memory corruption in HMAC handling Dan Rosenberg (Oct 04)
- Re: CVE request: kernel: SCTP memory corruption in HMAC handling Josh Bressers (Oct 04)