Linux Kernel SCTP_SetSockOpt Integer Overflow Vulnerability
BID:10326
Info
Linux Kernel SCTP_SetSockOpt Integer Overflow Vulnerability
| Bugtraq ID: | 10326 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 11 2004 12:00AM |
| Updated: | May 11 2004 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Shaun Colley <[email protected]>. |
| Vulnerable: |
Linux kernel 2.4.25 Linux kernel 2.4.24 -ow1 Linux kernel 2.4.24 Linux kernel 2.4.23 -pre9 Linux kernel 2.4.23 -ow2 Linux kernel 2.4.23 Linux kernel 2.4.22 Linux kernel 2.4.21 pre7 Linux kernel 2.4.21 pre4 Linux kernel 2.4.21 pre1 Linux kernel 2.4.21 Linux kernel 2.4.20 Linux kernel 2.4.19 -pre6 Linux kernel 2.4.19 -pre5 Linux kernel 2.4.19 -pre4 Linux kernel 2.4.19 -pre3 Linux kernel 2.4.19 -pre2 Linux kernel 2.4.19 -pre1 Linux kernel 2.4.19 Linux kernel 2.4.18 pre-8 Linux kernel 2.4.18 pre-7 Linux kernel 2.4.18 pre-6 Linux kernel 2.4.18 pre-5 Linux kernel 2.4.18 pre-4 Linux kernel 2.4.18 pre-3 Linux kernel 2.4.18 pre-2 Linux kernel 2.4.18 pre-1 Linux kernel 2.4.18 x86 Linux kernel 2.4.18 Linux kernel 2.4.17 Linux kernel 2.4.16 Linux kernel 2.4.15 Linux kernel 2.4.14 Linux kernel 2.4.13 Linux kernel 2.4.12 Linux kernel 2.4.11 Linux kernel 2.4.10 Linux kernel 2.4.9 Linux kernel 2.4.8 Linux kernel 2.4.7 Linux kernel 2.4.6 Linux kernel 2.4.5 Linux kernel 2.4.4 Linux kernel 2.4.3 Linux kernel 2.4.2 Linux kernel 2.4.1 Linux kernel 2.4 .0-test9 Linux kernel 2.4 .0-test8 Linux kernel 2.4 .0-test7 Linux kernel 2.4 .0-test6 Linux kernel 2.4 .0-test5 Linux kernel 2.4 .0-test4 Linux kernel 2.4 .0-test3 Linux kernel 2.4 .0-test2 Linux kernel 2.4 .0-test12 Linux kernel 2.4 .0-test11 Linux kernel 2.4 .0-test10 Linux kernel 2.4 .0-test1 Linux kernel 2.4 Linux kernel 2.3.99 -pre7 Linux kernel 2.3.99 -pre6 Linux kernel 2.3.99 -pre5 Linux kernel 2.3.99 -pre4 Linux kernel 2.3.99 -pre3 Linux kernel 2.3.99 -pre2 Linux kernel 2.3.99 -pre1 Linux kernel 2.3.99 Linux kernel 2.3 .x Linux kernel 2.3 Linux kernel 2.2.25 Linux kernel 2.2.24 Linux kernel 2.2.23 Linux kernel 2.2.22 Linux kernel 2.2.21 Linux kernel 2.2.20 Linux kernel 2.2.19 Linux kernel 2.2.18 Linux kernel 2.2.17 Linux kernel 2.2.16 pre6 Linux kernel 2.2.16 Linux kernel 2.2.15 pre20 Linux kernel 2.2.15 pre16 Linux kernel 2.2.15 Linux kernel 2.2.14 Linux kernel 2.2.13 Linux kernel 2.2.12 Linux kernel 2.2.11 Linux kernel 2.2.10 Linux kernel 2.2.9 Linux kernel 2.2.8 Linux kernel 2.2.7 Linux kernel 2.2.6 Linux kernel 2.2.5 Linux kernel 2.2.4 Linux kernel 2.2.3 Linux kernel 2.2.2 Linux kernel 2.2.1 Linux kernel 2.2 .x Linux kernel 2.2 Linux kernel 2.1.89 Linux kernel 2.1 .x Linux kernel 2.1 Linux kernel 2.0.39 Linux kernel 2.0.38 Linux kernel 2.0.37 Linux kernel 2.0.36 Linux kernel 2.0.35 Linux kernel 2.0.34 Linux kernel 2.0.33 Linux kernel 2.0.32 Linux kernel 2.0.31 Linux kernel 2.0.30 Linux kernel 2.0.29 Linux kernel 2.0.28 Linux kernel 2.0.27 Linux kernel 2.0.26 Linux kernel 2.0.25 Linux kernel 2.0.24 Linux kernel 2.0.23 Linux kernel 2.0.22 Linux kernel 2.0.21 Linux kernel 2.0.20 Linux kernel 2.0.19 Linux kernel 2.0.18 Linux kernel 2.0.17 Linux kernel 2.0.16 Linux kernel 2.0.15 Linux kernel 2.0.14 Linux kernel 2.0.13 Linux kernel 2.0.12 Linux kernel 2.0.11 Linux kernel 2.0.10 Linux kernel 2.0.9 Linux kernel 2.0.8 Linux kernel 2.0.7 Linux kernel 2.0.6 Linux kernel 2.0.5 Linux kernel 2.0.4 Linux kernel 2.0.3 Linux kernel 2.0.2 Linux kernel 2.0.1 Linux kernel 2.0 .x Linux kernel 2.0 |
| Not Vulnerable: | |
Discussion
Linux Kernel SCTP_SetSockOpt Integer Overflow Vulnerability
An integer overflow vulnerability has been reported in the sctp_setsockopt() system call of the Linux kernel. This issue is related to the code for handling the SCTP_SOCKOPT_DEBUG_NAME socket option.
The issue presents itself in the sctp_setsockopt() function of the net/sctp/socket.c source file, due to a lack of sufficient validation performed on user supplied integer values.
This vulnerability may result in the allocation of a 32 or 64 byte chunk in kernel memory space. Likely resulting in a kernel panic on a subsequent copy into memory operation. The issue may also potentially be exploited however to compromise the system.
This vulnerability is reported to affect Linux kernel versions up to and including version 2.4.25.
An integer overflow vulnerability has been reported in the sctp_setsockopt() system call of the Linux kernel. This issue is related to the code for handling the SCTP_SOCKOPT_DEBUG_NAME socket option.
The issue presents itself in the sctp_setsockopt() function of the net/sctp/socket.c source file, due to a lack of sufficient validation performed on user supplied integer values.
This vulnerability may result in the allocation of a 32 or 64 byte chunk in kernel memory space. Likely resulting in a kernel panic on a subsequent copy into memory operation. The issue may also potentially be exploited however to compromise the system.
This vulnerability is reported to affect Linux kernel versions up to and including version 2.4.25.
Exploit / POC
Linux Kernel SCTP_SetSockOpt Integer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Linux Kernel SCTP_SetSockOpt Integer Overflow Vulnerability
Solution:
It is reported that this issue has been resolved in Linux kernel 2.4.6 and 2.6. Customers are advised to upgrade to address this and other issues.
Trustix has released an advisory TSLSA-2004-0029 to address this issue. Please see the referenced advisory for more information.
Solution:
It is reported that this issue has been resolved in Linux kernel 2.4.6 and 2.6. Customers are advised to upgrade to address this and other issues.
Trustix has released an advisory TSLSA-2004-0029 to address this issue. Please see the referenced advisory for more information.
References
Linux Kernel SCTP_SetSockOpt Integer Overflow Vulnerability
References:
References:
- kernel.org Homepage. (Linux Kernel)
- Linux Kernel sctp_setsockopt() Integer Overflow (Shaun Colley
- Re: Linux Kernel sctp_setsockopt() Integer Overflow (Michael Tokarev