[v2.3] CVE-2013-2206 Linux kernel: sctp: duplicate cookie handling NULL pointer dereference
A flaw was found in the way Linux kernel’s SCTP network protocol
implementation handled duplicate cookies. A transient empty
association
is created while processing the duplicate cookie chunk that userspace
could query, potentially leading to NULL pointer dereference. A remote
attacker able to initiate SCTP connection to the system could use this
flaw to create transient conditions that could lead to remote system
crash if remote system user is querying SCTP connection info at the
time
these conditions exist.
Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f2815633504b442ca0b0605c16bf3d88a3a0fcea
(already in stable)
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=976562
(from redmine: issue id 2107, created on 2013-06-21, closed on 2013-06-26)
- Relations:
- parent #2105 (closed)