CVE-2014-3673: Input Validation
Kernel panic (via skboverpanic) is encountered when sctp stack receive a malformed asconf chunks.
skboverpanic: text:ffffffffa01ea1c3 len:31056 put:30768 head:ffff88011bd81800 data:ffff88011bd81800 tail:0x7950 end:0x440 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:129! [...] Call Trace: <IRQ> [<ffffffff8144fb1c>] skbput+0x5c/0x70 [<ffffffffa01ea1c3>] sctpaddtochunk+0x63/0xd0 [sctp] [<ffffffffa01eadaf>] sctpprocessasconf+0x1af/0x540 [sctp] [<ffffffff8152d025>] ? readunlockbh+0x15/0x20 [<ffffffffa01e0038>] sctpsfdoasconf+0x168/0x240 [sctp] ...
A remote attacker could use this flaw to crash the system.
Acknowledgements:
This issue was discovered by Liu Wei of Red Hat.
Other sources
The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/smmakechunk.c and net/sctp/smstatefuns.c.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3673?
CVE-2014-3673 is considered a serious vulnerability as it can lead to a kernel panic when the SCTP stack receives malformed ASCONF chunks.
How do I fix CVE-2014-3673?
To fix CVE-2014-3673, ensure that you update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or later versions that include patches for this vulnerability.
Which systems are affected by CVE-2014-3673?
CVE-2014-3673 affects various versions of the Linux kernel including those between 2.6.12 and 3.17, along with certain versions of Red Hat Enterprise Linux, Ubuntu, Oracle Linux, and SUSE Linux.
What are the potential impacts of CVE-2014-3673?
The potential impacts of CVE-2014-3673 include system instability and crashes due to kernel panic, which can disrupt service and compromise system reliability.
Is there a workaround for CVE-2014-3673?
There is no official workaround for CVE-2014-3673; upgrading the kernel is the recommended approach to mitigate the vulnerability.