CVE-2014-4667: Medium severity linux kernel vulnerability
Description of the problem: For a TCP-style socket, while processing the COOKIEECHO chunk in sctpsfdo51Dce(), after it has passed a series of sanity check, a new association would be created in sctpunpackcookie(), but afterwards, some processing maybe failed, and sctpassociationfree() will be called to free the previously allocated association, in sctpassociationfree(), skackbacklog value is decremented for this socket, since the initial value for skackbacklog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full.
A remote attacker can block further connection to the particular sctp server socket by sending a specially crafted sctp packet.
Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d3217b15a19a4779c39b212358a5c71d725822ee
Acknowledgements:
Red Hat would like to thank Gopal Reddy Kodudula of Nokia Siemens Networks for reporting this issue.
Other sources
The sctpassociationfree function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4667?
CVE-2014-4667 is rated as a medium severity vulnerability.
How do I fix CVE-2014-4667?
To fix CVE-2014-4667, upgrade to kernel versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
What systems are affected by CVE-2014-4667?
CVE-2014-4667 affects Linux Kernel versions up to 3.15.2, SUSE Linux Enterprise Desktop 11 SP3, and Ubuntu 12.04.
What type of vulnerability is CVE-2014-4667?
CVE-2014-4667 is a vulnerability in the SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel.
Can CVE-2014-4667 lead to denial of service attacks?
Yes, CVE-2014-4667 could be exploited to cause denial of service conditions in affected systems.