Executive brief
A vulnerability exists in the Linux kernel's implementation of the SCTP protocol, which is used for transporting data over networks. The system performs security checks (MAC comparisons) in a way that reveals timing information, potentially allowing an attacker to bypass authentication. If exploited, this could allow an unauthorized user to intercept or modify network traffic, impacting data confidentiality and integrity.
Technical details
A timing side-channel vulnerability exists in the SCTP (Stream Control Transmission Protocol) implementation within the Linux kernel. The vulnerability is located in 'net/sctp/sm_make_chunk.c' and 'net/sctp/sm_statefuns.c', where Message Authentication Codes (MACs) were compared using 'memcmp' instead of a constant-time comparison function. This allows a remote attacker to potentially conduct a timing attack to forge valid MACs for AUTH chunks or cookies. An attacker could achieve authentication bypass, leading to unauthorized data access or modification. The issue has been resolved by replacing 'memcmp' with 'crypto_memneq' to ensure constant-time execution regardless of the input.
Affected products
- Linux Linux Kernel 2.6.12 to 6.11.x
Timeline
- 2025-08-18: disclosed: Initial patch submitted by Eric Biggers
- 2025-10-19: patched: Patch committed to stable kernel branches
- 2025-11-12: advisory: CVE-2025-40204 published
References
- https://git.kernel.org/stable/c/0b32ff285ff6f6f1ac1d9495787ccce8837d6405
- https://git.kernel.org/stable/c/0e8b8c326c2a6de4d837b1bb034ea704f4690d77
- https://git.kernel.org/stable/c/1cd60e0d0fb8f0e62ec4499138afce6342dc9d4c
- https://git.kernel.org/stable/c/8019b3699289fce3f10b63f98601db97b8d105b0
- https://git.kernel.org/stable/c/9c05d44ec24126fc283835b68f82dba3ae985209
- https://git.kernel.org/stable/c/b93fa8dc521d00d2d44bf034fb90e0d79b036617
- https://git.kernel.org/stable/c/dd91c79e4f58fbe2898dac84858033700e0e99fb