CVE-2006-2274: Medium severity lksctp Stream Control Transmission Protocol vulnerability
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (infinite recursion and crash) via a packet that contains two or more DATA fragments, which causes an skb pointer to refer back to itself when the full message is reassembled, leading to infinite recursion in the sctpskbpull function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2274?
CVE-2006-2274 is considered a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2006-2274?
To fix CVE-2006-2274, upgrade to lksctp version 2.6.17 or later, which addresses the vulnerability.
What kind of attack does CVE-2006-2274 represent?
CVE-2006-2274 represents an attack that allows remote attackers to cause a denial of service through infinite recursion.
Which version of Linux SCTP is affected by CVE-2006-2274?
Linux SCTP versions prior to 2.6.17 are affected by CVE-2006-2274.
Is CVE-2006-2274 related to data fragmentation issues?
Yes, CVE-2006-2274 is related to issues with packet fragmentation that can lead to infinite recursion.