CVE-2014-8613: Null Pointer Dereference

Published Feb 2, 2015

Updated

The sctp module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8.4 before p23 allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted RECONFIG chunk.

Affected Software

3 affected components

FreeBSD FreeBSD=8.4

FreeBSD FreeBSD=9.3

FreeBSD FreeBSD=10.1

Event History

Feb 2, 2015

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8613?

CVE-2014-8613 is considered a high-severity vulnerability due to its potential to cause a denial of service.

What systems are affected by CVE-2014-8613?

CVE-2014-8613 affects FreeBSD versions 8.4, 9.3, and 10.1 before their respective patches.

How do I fix CVE-2014-8613?

To mitigate CVE-2014-8613, upgrade your FreeBSD system to the patched versions 8.4-p23, 9.3-p9, or 10.1-p5.

What type of attack does CVE-2014-8613 allow?

CVE-2014-8613 allows remote attackers to perform a denial of service attack through a crafted RE_CONFIG chunk.

Is there a workaround for CVE-2014-8613?

There is no specific workaround for CVE-2014-8613; applying the available security patches is the recommended solution.