PT-2026-51898 · Linux · Linux
Publicado
2026-06-24
·
Atualizado
2026-06-24
·
CVE-2026-53004
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix OOB write to userspace in sctp getsockopt peer auth chunks
sctp getsockopt peer auth chunks() checks that the caller's optval
buffer is large enough for the peer AUTH chunk list with
if (len < num chunks)
return -EINVAL;
but then writes num chunks bytes to p->gauth chunks, which lives
at offset offsetof(struct sctp authchunks, gauth chunks) == 8
inside optval. The check is missing the sizeof(struct
sctp authchunks) = 8-byte header. When the caller supplies
len == num chunks (for any num chunks > 0) the test passes but
copy to user() writes sizeof(struct sctp authchunks) = 8 bytes
past the declared buffer.
The sibling function sctp getsockopt local auth chunks() at the
next line already has the correct check:
if (len < sizeof(struct sctp authchunks) + num chunks)
return -EINVAL;
Align the peer variant with its sibling.
Reproducer confirms on v7.0-13-generic: an unprivileged userspace
caller that opens a loopback SCTP association with AUTH enabled,
queries num chunks with a short optval, then issues the real
getsockopt with len == num chunks and sentinel bytes painted past
the buffer observes those sentinel bytes overwritten with the
peer's AUTH chunk type. The bytes written are under the peer's
control but land in the caller's own userspace; this is not a
kernel memory corruption, but it is a kernel-side contract
violation that can silently corrupt adjacent userspace data.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux