CVE-2010-3705: High severity Linux Linux kernel vulnerability
Description of problem:
When parsing a peer's supported HMAC authentication options in the sctpauthasocgethmac() function, a malicious peer can craft their HMAC array in such a way as to cause memory corruption (out-of-bounds read followed by use of retrieved out-of-bounds data), which at the very least could cause a denial of service via kernel panic, and possibly worse. It appears this could be triggered remotely when connecting to a malicious peer, or locally by a user acting as both endpoints. In both cases, the "authenable" sysctl must be set in order to trigger the bug.
References: http://marc.info/?l=oss-security&m=128619854321910&w=1 http://marc.info/?l=linux-kernel&m=128596992418814&w=2
Other sources
The sctpauthasocgethmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmacids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3705?
CVE-2010-3705 has a high severity rating due to the potential for memory corruption and exploitation by a malicious peer.
How does CVE-2010-3705 affect systems?
CVE-2010-3705 can lead to out-of-bounds read and memory corruption in systems using the affected Linux kernel versions.
Which systems are affected by CVE-2010-3705?
CVE-2010-3705 affects various Linux distributions including Debian, Fedora, and multiple versions of Ubuntu.
How do I fix CVE-2010-3705?
To fix CVE-2010-3705, upgrade to a patched version of the Linux kernel that addresses the vulnerability.
When was CVE-2010-3705 reported?
CVE-2010-3705 was reported in October 2010.