oss-security - Kernel local root in SCTP / CVE-2019-8956

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 21 Feb 2019 13:57:50 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: Kernel local root in SCTP / CVE-2019-8956

Hi,

CVE-2019-8956 

Secunia just announced this a local root in SCTP:

	https://secuniaresearch.flexerasoftware.com/secunia_research/2019-5/

There was a SCTP local root in the kernel due to a association list
corruption.

https://lore.kernel.org/netdev/20190201141522.GA20785@kroah.com/

In sctp_sendmesg(), when walking the list of endpoint associations, the
association can be dropped from the list, making the list corrupt.
Properly handle this by using list_for_each_entry_safe()

Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg")

This issue is in 4.17 up to 5.0rc6.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.