Executive brief
The Linux kernel's SCTP protocol handler improperly validates embedded address parameters during connection setup and configuration changes, allowing a malformed remote peer to trigger out-of-bounds memory reads. An attacker with network access to a system using SCTP can crash the system or potentially extract sensitive kernel memory, disrupting service availability and potentially compromising confidential data.
Technical details
The vulnerability exists in sctp_verify_asconf() and sctp_verify_param() functions in net/sctp/sm_make_chunk.c. These functions validate ADD_IP, DEL_IP, and SET_PRIMARY address parameters only against a fixed minimum size, ensuring the outer parameter header fits but not validating that the embedded address parameter's declared length stays within the outer parameter bounds. Later, sctp_process_param() and sctp_process_asconf_param() extract and process the embedded address parameter using its declared length without re-validation, leading to out-of-bounds reads. The fix adds explicit length validation to ensure addr_param->p.length does not exceed the available space within the enclosing parameter before parsing. A remote attacker can trigger this via malformed INIT or ASCONF messages during SCTP association establishment or modification.
Affected products
- Linux Linux kernel All versions from 2.6.12-rc2 (prior to fix commit e9361d0ca55c4af12aac09e2572852fa91046229)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Fix merged into stable tree
- 2026-06-09: other: Patch authored by Xin Long