CVE-2013-4350: Medium severity linux kernel vulnerability
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116) 192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72 22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340) 192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364) fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp 1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
References: https://bugzilla.kernel.org/showbug.cgi?id=24412
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=95ee62083cb6453e056562d91f597552021e6ae7
Other sources
The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4350?
CVE-2013-4350 is rated as a significant vulnerability due to its impact on IPsec encryption for SCTP over IPv6.
How do I fix CVE-2013-4350?
To fix CVE-2013-4350, update to the recommended Linux kernel versions or later that address this vulnerability.
Which software versions are affected by CVE-2013-4350?
CVE-2013-4350 affects multiple Linux kernel versions starting from 3.0 up to 3.11.1, specifically the early releases.
What type of vulnerability is CVE-2013-4350?
CVE-2013-4350 is a vulnerability related to improper encryption handling in IPsec when using SCTP over IPv6.
Can CVE-2013-4350 be exploited remotely?
Yes, CVE-2013-4350 can potentially be exploited remotely if the affected systems are exposed to an untrusted network.