oss-security - CVE request: kernel: SCTP memory corruption in HMAC handling

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 4 Oct 2010 09:21:55 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Cc: Eugene Teo <eugeneteo@...nel.sg>
Subject: CVE request: kernel: SCTP memory corruption in HMAC handling

Reference:
http://marc.info/?l=linux-kernel&m=128596992418814&w=2

When parsing a peer's supported HMAC authentication options in the
sctp_auth_asoc_get_hmac() function, a malicious peer can craft their
HMAC array in such a way as to cause memory corruption (out-of-bounds
read followed by use of retrieved out-of-bounds data), which at the
very least could cause a denial of service via kernel panic, and
possibly worse.  It appears this could be triggered remotely when
connecting to a malicious peer, or locally by a user acting as both
endpoints.  In both cases, the "auth_enable" sysctl must be set in
order to trigger the bug.

-Dan

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.