CVE-2014-0101: Null Pointer Dereference
Description of the problem:
A flaw was found in the way Linux kernel processed authenticated COOKIEECHO chunks.
A remote attacker could use this flaw to crash the system by sending a maliciously prepared SCTP handshake in order to trigger a NULL pointer dereference on the server.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bbd0d59809f9
Acknowledgements:
Red Hat would like to thank Nokia Siemens Networks for reporting this issue.
Other sources
The sctpsfdo51Dce function in net/sctp/smstatefuns.c in the Linux kernel through 3.13.6 does not validate certain authenable and authcapable fields before making an sctpsfauthenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIEECHO chunk.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Patch bbd0d59809f9
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0101?
CVE-2014-0101 is classified as a high severity vulnerability due to its potential to crash affected systems.
How do I fix CVE-2014-0101?
To fix CVE-2014-0101, update your Linux kernel to the latest version that is not affected by this vulnerability.
Which versions of the Linux kernel are vulnerable to CVE-2014-0101?
CVE-2014-0101 affects Linux kernel versions from 2.6.24 up to 3.12.15.
Can CVE-2014-0101 be exploited remotely?
Yes, CVE-2014-0101 can be exploited remotely by sending a malicious SCTP handshake to the server.
What systems are affected by CVE-2014-0101?
CVE-2014-0101 affects various distributions of the Linux kernel, including Debian, Red Hat, and Ubuntu.