Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can force the usage of a freed memory area via SCTP
INIT packets sent to the Linux kernel, in order to trigger a
denial of service, and possibly to execute code.

– Impacted products: Linux
– Severity: 2/4
– Creation date: 29/01/2015

DESCRIPTION OF THE VULNERABILITY

The SCTP protocol is used to transport several message streams,
multiplexed over one connection.

However, when two SCTP INIT packets are received simultaneously,
the sctp_assoc_update() function frees a memory area before
reusing it.

An attacker can therefore force the usage of a freed memory area
via SCTP INIT packets sent to the Linux kernel, in order to
trigger a denial of service, and possibly to execute code.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Linux-kernel-use-after-free-via-SCTP-INIT-16086