The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-firmwareUpgrade kernel-develUpgrade kernelUpgrade kernel-headersUpgrade kernel-docUpgrade python-perfUpgrade perfUpgrade kernel-abi-whitelists | Dec 1, 2016 | Mar 11, 2014 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 11, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 4, 2015 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | Mar 11, 2014 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-docs | Dec 18, 2015 | Mar 11, 2014 |
| Ubuntu | — | Upgrade linux-image-3.2.0-63-virtualUpgrade linux-image-2.6.32-58-386Upgrade linux-image-3.2.0-63-highbankUpgrade linux-image-2.6.32-58-powerpc-smpUpgrade linux-image-2.6.32-58-lpiaUpgrade linux-image-2.6.32-58-powerpc64-smpUpgrade linux-image-2.6.32-58-powerpcUpgrade linux-image-2.6.32-58-serverUpgrade linux-image-3.2.0-1446-omap4Upgrade linux-image-3.2.0-63-generic-paeUpgrade linux-image-2.6.32-58-versatileUpgrade linux-image-3.11.0-22-genericUpgrade linux-image-3.2.0-63-genericUpgrade linux-image-3.8.0-41-genericUpgrade linux-image-2.6.32-58-preemptUpgrade linux-image-2.6.32-58-generic-paeUpgrade linux-image-2.6.32-58-ia64Upgrade linux-image-3.2.0-63-powerpc-smpUpgrade linux-image-2.6.32-58-sparc64Upgrade linux-image-2.6.32-58-virtualUpgrade linux-image-3.2.0-63-powerpc64-smpUpgrade linux-image-2.6.32-58-sparc64-smpUpgrade linux-image-3.5.0-51-genericUpgrade linux-image-2.6.32-58-genericUpgrade linux-image-2.6.32-363-ec2Upgrade linux-image-3.2.0-63-omapUpgrade linux-image-3.11.0-22-generic-lpae | Nov 8, 2024 | Mar 11, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub