CVE-2014-5077: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system.
Other sources
Linux kernel built with the support for Stream Control Transmission Protocol (CONFIGIPSCTP) is vulnerable to a NULL pointer dereference flaw. It could occur when simultaneous new connections are initiated between the same pair of hosts.
A remote user/program could use this flaw to crash the system kernel resulting in DoS.
Upstream fix: ------------- -> http://patchwork.ozlabs.org/patch/372475/
— Red Hat
The sctpassocupdate function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-5077?
CVE-2014-5077 is classified as a high severity vulnerability due to its potential to cause system crashes.
How do I fix CVE-2014-5077?
To fix CVE-2014-5077, you should upgrade the affected Linux kernel to a patched version as recommended by your distribution.
Which Linux kernels are affected by CVE-2014-5077?
CVE-2014-5077 affects various Linux kernel versions including 2.6.32 and specific versions up to 3.10.
Can CVE-2014-5077 be exploited remotely?
Yes, CVE-2014-5077 can be exploited remotely by an attacker to crash the system through SCTP connections.
What type of vulnerability is CVE-2014-5077?
CVE-2014-5077 is a NULL pointer dereference flaw in the SCTP implementation of the Linux kernel.