CVE-2011-1573: Medium severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
net/sctp/smmakechunk.c in the Linux kernel before 2.6.34, when addipenable and authenable are used, does not consider the amount of zero padding during calculation of chunk lengths for (1) INIT and (2) INIT ACK chunks, which allows remote attackers to cause a denial of service (OOPS) via crafted packet data.
— Launchpad
When calculating the INIT/INIT-ACK chunk length, we should not only account the length of parameters, but also the parameters zero padding length, such as AUTH HMACS parameter and CHUNKS parameter. Without the parameters zero padding length we may get following oops.
skboverpanic: text:ce2068d2 len:130 put:6 head:cac3fe00 data:cac3fe00 tail:0xcac3fe82 end:0xcac3fe80 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:127! invalid opcode: 0000 [#2] SMP last sysfs file: /sys/module/aesgeneric/initstate Modules linked in: authenc ......
Pid: 4102, comm: sctpdarn Tainted: G D 2.6.34-rc2 #6 EIP: 0060:[<c0607630>] EFLAGS: 00010282 CPU: 0 EIP is at skboverpanic+0x37/0x3e EAX: 00000078 EBX: c07c024b ECX: c07c02b9 EDX: cb607b78 ESI: 00000000 EDI: cac3fe7a EBP: 00000002 ESP: cb607b74 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process sctpdarn (pid: 4102, ti=cb607000 task=cabdc990 task.ti=cb607000) Stack: c07c02b9 ce2068d2 00000082 00000006 cac3fe00 cac3fe00 cac3fe82 cac3fe80 <0> c07c024b cac3fe7c cac3fe7a c0608dec ca986e80 ce2068d2 00000006 0000007a <0> cb8120ca ca986e80 cb812000 00000003 cb8120c4 ce208a25 cb8120ca cadd9400 Call Trace: [<ce2068d2>] ? sctpaddtochunk+0x45/0x85 [sctp] [<c0608dec>] ? skbput+0x2e/0x32 [<ce2068d2>] ? sctpaddtochunk+0x45/0x85 [sctp] [<ce208a25>] ? sctpmakeinit+0x279/0x28c [sctp] [<c0686a92>] ? apictimerinterrupt+0x2a/0x30 [<ce1fdc0b>] ? sctpsfdoprmasoc+0x2b/0x7b [sctp] [<ce202823>] ? sctpdosm+0xa0/0x14a [sctp] [<ce2133b9>] ? sctppname+0x0/0x14 [sctp] [<ce211d72>] ? sctpprimitiveASSOCIATE+0x2b/0x31 [sctp] [<ce20f3cf>] ? sctpsendmsg+0x7a0/0x9eb [sctp] [<c064eb1e>] ? inetsendmsg+0x3b/0x43 [<c04244b7>] ? tasktickfair+0x2d/0xd9 [<c06031e1>] ? socksendmsg+0xa7/0xc1 [<c0416afe>] ? smpapictimerinterrupt+0x6b/0x75 [<c0425123>] ? dequeuetaskfair+0x34/0x19b [<c0446abb>] ? schedclocklocal+0x17/0x11e [<c052ea87>] ? copyfromuser+0x2b/0x10c [<c060ab3a>] ? verifyiovec+0x3c/0x6a [<c06035ca>] ? syssendmsg+0x186/0x1e2 [<c042176b>] ? wakeupcommon+0x34/0x5b [<c04240c2>] ? wakeup+0x2c/0x3b [<c057e35c>] ? ttywakeup+0x43/0x47 [<c04430f2>] ? removewaitqueue+0x16/0x24 [<c0580c94>] ? nttyread+0x5b8/0x65e [<c042be02>] ? defaultwakefunction+0x0/0x8 [<c0604e0e>] ? syssocketcall+0x17f/0x1cd [<c040264c>] ? sysenterdocall+0x12/0x22 Code: 0f 45 de 53 ff b0 98 00 00 00 ff b0 94 ...... EIP: [<c0607630>] skboverpanic+0x37/0x3e SS:ESP 0068:cb607b74
To reproduce:
modprobe sctp echo 1 > /proc/sys/net/sctp/addipenable echo 1 > /proc/sys/net/sctp/authenable sctptest -H 3ffe:501:ffff:100:20c:29ff:fe4d:f37e -P 800 -l sctpdarn -H 3ffe:501:ffff:100:20c:29ff:fe4d:f37e -P 900 -h 192.168.0.21 -p 800 -I -s -t sctpdarn ready to send... 3ffe:501:ffff:100:20c:29ff:fe4d:f37e:900-192.168.0.21:800 Interactive mode> bindx-add=192.168.0.21 3ffe:501:ffff:100:20c:29ff:fe4d:f37e:900-192.168.0.21:800 Interactive mode> bindx-add=192.168.1.21 3ffe:501:ffff:100:20c:29ff:fe4d:f37e:900-192.168.0.21:800 Interactive mode> snd=10
------------------------------------------------------------------ eth0 has addresses: 3ffe:501:ffff:100:20c:29ff:fe4d:f37e and 192.168.0.21 eth1 has addresses: 192.168.1.21 ------------------------------------------------------------------
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1573?
CVE-2011-1573 is classified as a high severity vulnerability due to the potential for remote denial of service attacks.
How do I fix CVE-2011-1573?
To fix CVE-2011-1573, upgrade the Linux kernel to version 2.6.34 or later.
What are the potential impacts of CVE-2011-1573?
The potential impacts of CVE-2011-1573 include remote denial of service, which can disrupt service availability.
Is CVE-2011-1573 exploitable on all Linux distributions?
CVE-2011-1573 is exploitable on Linux systems using kernel versions prior to 2.6.34 where addip_enable and auth_enable are active.
How was CVE-2011-1573 discovered?
CVE-2011-1573 was discovered through vulnerability reports and code analysis within the Linux kernel's SCTP implementation.