PT-2026-65226 · Linux · Linux
CVE-2026-64551
·
Publicado
2026-07-27
·
Atualizado
2026-07-27
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate STALE COOKIE cause length before reading staleness
When an ERROR chunk with a STALE COOKIE cause is received in the
COOKIE ECHOED state, sctp sf do 5 2 6 stale() reads the 4-byte Measure
of Staleness that follows the cause header:
err = (struct sctp errhdr *)(chunk->skb->data);
stale = ntohl(*( be32 *)((u8 *)err + sizeof(*err)));err is the first cause in the chunk, not the STALE COOKIE cause that
caused the dispatch, and nothing guarantees the staleness field is
present. sctp walk errors() only requires a cause to be as long as the
4-byte header, so for a STALE COOKIE cause of length 4 the read runs
past the cause, and for a minimal ERROR chunk past skb->tail. The value
is echoed to the peer in the Cookie Preservative of the reply INIT,
leaking uninitialized memory.
sctp sf cookie echoed err() already walks to the STALE COOKIE cause, so
check its length there and pass it to sctp sf do 5 2 6 stale(), which
reads that cause instead of the first one. A STALE COOKIE cause too
short to hold the staleness field is discarded.
The read is reachable by any peer that can drive an association into
COOKIE ECHOED, including an unprivileged process using a raw SCTP socket
in a user and network namespace.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux