In the Linux kernel, the following vulnerability has been resolved:
sctp: add INIT verification after cookie unpacking
In SCTP handshake, the INIT chunk is initially processed by the server
and embedded into the cookie carried in INIT-ACK. The client then
returns this cookie via COOKIE-ECHO, where the server unpacks it and
reconstructs the original INIT chunk.
When cookie authentication is enabled, the cookie contents are protected
against tampering, so reusing the unpacked INIT without re-verification
is safe.
However, when cookie authentication is disabled, the reconstructed INIT
can no longer be trusted. In this case, the INIT must be explicitly
validated after unpacking to avoid processing potentially tampered data.
Add sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO
processing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook())
when cookie_auth_enable is disabled. On failure, the new association is
freed and the packet is discarded.
Also tighten cookie validation in sctp_unpack_cookie() by verifying the
embedded chunk type is SCTP_CID_INIT before treating it as an INIT
chunk.
Finally, update sctp_verify_init() to validate parameter bounds using
the actual embedded INIT length instead of chunk->chunk_end, since the
INIT stored in COOKIE-ECHO may not span the entire chunk buffer.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The bug is reached when a remote peer sends SCTP COOKIE-ECHO packets to a listening endpoint; packets enter through sctp_rcv()/IPv4/IPv6 SCTP handlers and are dispatched to COOKIE-ECHO state handlers without any local access requirement.
AC:L - On deployments with SCTP cookie authentication disabled (supported via cookie_hmac_alg=none), an attacker can complete INIT/INIT-ACK, tamper with the embedded INIT in the returned cookie, and reliably trigger the vulnerable path with crafted COOKIE-ECHO traffic.
PR:N - Exploitation is pre-authentication SCTP handshake processing on a listening server; the attacker only needs network reachability to the SCTP port and does not need local privileges, credentials, or CAP_NET_ADMIN on the target.
UI:N - No victim user action is required beyond operating an SCTP listener; exploitation is achieved solely by sending attacker-crafted SCTP handshake packets over the network.
S:U - The vulnerability affects the Linux kernel SCTP stack on the target host and does not cross a separate security boundary such as guest-to-host VM escape, container sandbox escape, or IOMMU/DMA isolation bypass.
C:H - Without sctp_verify_init() and with incorrect INIT parameter bound checks, attacker-controlled embedded INIT lengths/types can drive sctp_walk_params() and kmemdup() beyond valid cookie data, enabling out-of-bounds kernel memory reads.
I:H - Tampered or type-confused embedded INIT data is parsed into association/peer state via sctp_process_init() without full validation, causing kernel memory-safety corruption that can modify association structures and plausibly be leveraged for stronger write primitives.
A:H - Malformed embedded INIT processing during COOKIE-ECHO handling can trigger kernel faults, KASAN/oops conditions, allocation failures, or repeated crashes of SCTP input processing, causing high availability impact on internet-facing SCTP services.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The bug is reached when a remote peer sends SCTP COOKIE-ECHO packets to a listening endpoint; packets enter through sctp_rcv()/IPv4/IPv6 SCTP handlers and are dispatched to COOKIE-ECHO state handlers without any local access requirement.
AC:L - On deployments with SCTP cookie authentication disabled (supported via cookie_hmac_alg=none), an attacker can complete INIT/INIT-ACK, tamper with the embedded INIT in the returned cookie, and reliably trigger the vulnerable path with crafted COOKIE-ECHO traffic.
PR:N - Exploitation is pre-authentication SCTP handshake processing on a listening server; the attacker only needs network reachability to the SCTP port and does not need local privileges, credentials, or CAP_NET_ADMIN on the target.
UI:N - No victim user action is required beyond operating an SCTP listener; exploitation is achieved solely by sending attacker-crafted SCTP handshake packets over the network.
S:U - The vulnerability affects the Linux kernel SCTP stack on the target host and does not cross a separate security boundary such as guest-to-host VM escape, container sandbox escape, or IOMMU/DMA isolation bypass.
C:H - Without sctp_verify_init() and with incorrect INIT parameter bound checks, attacker-controlled embedded INIT lengths/types can drive sctp_walk_params() and kmemdup() beyond valid cookie data, enabling out-of-bounds kernel memory reads.
I:H - Tampered or type-confused embedded INIT data is parsed into association/peer state via sctp_process_init() without full validation, causing kernel memory-safety corruption that can modify association structures and plausibly be leveraged for stronger write primitives.
A:H - Malformed embedded INIT processing during COOKIE-ECHO handling can trigger kernel faults, KASAN/oops conditions, allocation failures, or repeated crashes of SCTP input processing, causing high availability impact on internet-facing SCTP services.
CVSS 3.1