CVE-2008-2826: Integer Overflow
Integer overflow in the sctpgetsockoptlocaladdrsold function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service (resource consumption and system outage) via vectors involving a large addrnum field in an sctpgetaddrsold data structure.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2826?
CVE-2008-2826 is considered a high severity vulnerability that can lead to denial of service due to resource consumption and potential system outage.
How do I fix CVE-2008-2826?
To fix CVE-2008-2826, upgrade to a Linux kernel version 2.6.25.9 or later that includes the security patch.
What systems are affected by CVE-2008-2826?
CVE-2008-2826 affects various versions of the Linux kernel prior to 2.6.25.9, as well as specific distributions like openSUSE 10.3, 11.0, Debian 4.0, and several versions of Ubuntu.
What causes CVE-2008-2826?
CVE-2008-2826 is caused by an integer overflow in the sctp_getsockopt_local_addrs_old function within the SCTP implementation of the Linux kernel.
Can CVE-2008-2826 be exploited remotely?
CVE-2008-2826 is a local vulnerability, meaning it requires local user access to exploit and cause a denial of service.