CVE-2008-4445
Summary
| CVE | CVE-2008-4445 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2008-10-06 19:54:36 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | The sctp_auth_ep_set_hmacs function in net/sctp/auth.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, does not verify that the identifier index is within the bounds established by SCTP_AUTH_HMAC_ID_MAX, which allows local users to obtain sensitive information via a crafted SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function, a different vulnerability than CVE-2008-4113. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
MediumAuthentication
NoneConfidentiality
CompleteIntegrity
NoneAvailability
NoneAV:L/AC:M/Au:N/C:C/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | 2.2.27 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.4.36 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.4.36.1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.4.36.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.4.36.3 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.4.36.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.4.36.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.4.36.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.18 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.18 | rc1 | All | All |
| Operating System | Linux | Linux Kernel | 2.6.18 | rc2 | All | All |
| Operating System | Linux | Linux Kernel | 2.6.18 | rc3 | All | All |
| Operating System | Linux | Linux Kernel | 2.6.18 | rc4 | All | All |
| Operating System | Linux | Linux Kernel | 2.6.18 | rc5 | All | All |
| Operating System | Linux | Linux Kernel | 2.6.18 | rc6 | All | All |
| Operating System | Linux | Linux Kernel | 2.6.18 | rc7 | All | All |
| Operating System | Linux | Linux Kernel | 2.6.19.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.19.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.19.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.19.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.20.16 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.20.17 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.20.18 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.20.19 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.20.20 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.20.21 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.21.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.21.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.21.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.10 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.11 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.12 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.13 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.14 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.15 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.17 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.18 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.19 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.20 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.21 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.22 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.8 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22.9 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22_rc1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.22_rc7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.10 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.11 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.12 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.13 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.15 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.16 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.17 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.8 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23.9 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.23_rc1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.3 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24_rc1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24_rc4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24_rc5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.1 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.10 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.10 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.11 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.11 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.12 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.12 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.13 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.15 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.2 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.3 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.3 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.4 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.5 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.6 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.7 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.8 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.8 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | 2.6.25.9 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.9 | All | x86_64 | All |
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Support / Security / Advisories / / MDVSA-2008:223 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| 404: File not found | af854a3a-2127-422b-91ae-364da2661108 | www.kernel.org | |
| Red Hat update for kernel - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian update for linux-2.6 - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| '[PATCH 0/2] sctp: additional overflow fixes' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| '[PATCH 2/2] sctp: fix random memory dereference with SCTP_HMAC_IDENT option.' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Exploit |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| oss-security - Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| oss-security - Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Linux Kernel 'SCTP' Module Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| SecurityTracker.com Archives - Linux Kernel Validation Flaw in sctp_auth_ep_set_hmacs() Lets Local Users Obtain Potentially Sensitive Information | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Ubuntu update for linux - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| oss-security - Re: CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Debian -- Security Information -- DSA-1655-1 linux-2.6.24 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| USN-659-1: Linux kernel vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| git.kernel.org | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | |
| oss-security - CVE-2008-4113 update: kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| CONFIRM:http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=d97240552cd98c4b07322f30f66fd9c3ba4171de | MITRE | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-01-15 | Tomas Hoger | This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and 5. It was addressed in Red Hat Enterprise MRG for RHEL-5 via: https://rhn.redhat.com/errata/RHSA-2008-0857.html |
There are currently no legacy QID mappings associated with this CVE.