REDHAT-BUG-2418832: Medium severity linux/kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid NULL dereference when chunk data buffer is missing
chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only.
chunk->skb can only be NULL if chunk->headskb is not. Check for fraglist instead and do it just before replacing chunk->skb. We're sure that otherwise chunk->skb is non-NULL because of outer if() condition.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the crash?
The issue occurs when SCTP processes a chunk whose data buffer is missing: chunk->skb is NULL while chunk->head_skb is present. The vulnerable code dereferences chunk->skb in a path where it can be NULL.
What is the impact of successful triggering?
The described impact is a NULL-pointer dereference in the Linux kernel SCTP code, which can cause a kernel crash.
Which remediation is described?
The resolution changes the check to use frag_list immediately before replacing chunk->skb, avoiding dereference of a missing chunk->skb pointer.