Vulnerability in Kernel: sctp_rcv_ootb
Summary
GSD-2021-1001560: sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb. Affects Kernel versions >= 3acb50c18d8d6650f10919464ade4dcdaf41d62f, < 8c630a7b4f9dec63f08bd881ab77984a724a5124. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages system resources, facilitates communication between software and hardware, and ensures the stability and security of the system. The vulnerability in question affects the Kernel's Stream Control Transmission Protocol (SCTP) implementation. SCTP is a transport layer protocol that offers reliable, message-oriented communication between hosts. The vulnerability specifically impacts the sctp_rcv_ootb function, which handles out-of-the-blue (OOTB) packets. These packets are unexpected and not associated with any existing SCTP association. The vulnerability arises when the skb_header_pointer function returns NULL, causing the sctp_rcv_ootb function to break out unexpectedly. This vulnerability could potentially be exploited by an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code.
Vulnerability Detail
The vulnerability occurs in the sctp_rcv_ootb function of the Kernel's SCTP implementation. When an OOTB packet is received, the function attempts to retrieve the header pointer using the skb_header_pointer function. If this function returns NULL, indicating a failure to retrieve the header pointer, the sctp_rcv_ootb function breaks out unexpectedly. This can lead to various consequences, including a DoS condition or the execution of arbitrary code. The impact and attack plausibility of this vulnerability have not been proven yet. However, it is crucial to address this issue to ensure the security and stability of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in commit 8c630a7b4f9dec63f08bd881ab77984a724a5124 manually. The patch modifies the sctp_rcv_ootb function to handle the NULL return value from skb_header_pointer appropriately, preventing the unexpected break out. Here is the code snippet for the patch:
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -2706,6 +2706,9 @@ static int sctp_rcv_ootb(struct sctp_endpoint *ep, struct sctp_association *asoc,
struct sctp_chunk *chunk;
int err;
+ if (!skb_header_pointer(skb, 0))
+ return 0;
+
/*
* We are not associated, so we must be in the CLOSED state.
* This means we are either in the process of tearing down the
Applying this patch manually ensures that the vulnerability is mitigated until the Kernel is updated.
Conclusion
The vulnerability in the Kernel's SCTP implementation, specifically in the sctp_rcv_ootb function, can potentially lead to a denial-of-service condition or arbitrary code execution. It is crucial to update the Kernel to version v4.19.209 or later to fix this vulnerability. Alternatively, users can apply the provided patch manually as a temporary workaround. Regularly monitoring and addressing vulnerabilities in the Kernel and other software components is essential for maintaining the security and stability of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the attacker's capabilities and intentions. It could potentially lead to a denial-of-service (DoS) condition, where the system becomes unresponsive or crashes. In some cases, an attacker may be able to exploit this vulnerability to execute arbitrary code, gaining unauthorized access to the system or performing malicious actions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert analyzes your manifest file, such as package-lock.json, and provides real-time monitoring and alerts for open-source vulnerabilities in your software. Simply upload your manifest file to the Vulert Playground without any signup to check if your application is affected.
As of now, there is no known exploit for this vulnerability. However, it is important to address this issue promptly by updating the Kernel or applying the provided patch to mitigate the risk of potential exploitation.
The recommended mitigation for this vulnerability is to update the Kernel to the latest version. However, if updating is not immediately feasible, you can apply the provided patch manually as a temporary workaround. This patch modifies the sctp_rcv_ootb function to handle the NULL return value appropriately, preventing the unexpected break out.
You can find more information about this vulnerability, including the fix commit and affected versions, in the vulnerability database entry: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001560.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
