An use after free flaw was found in the Linux kernel SCTP implementation handled auth keys reference counting during INIT collisions.

A remote user could use this flaw to crash the system or, though unlikely, escalate their privileges on the system.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=600ddd6825543962fb807884169e57b580dba208

Acknowledgements:

This issue was discovered by Sun Baoliang of Red Hat.

drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) ozusbrx and (2) ozusbhandleepdata functions.

A flaw was found in the Linux kernels implementation of sctp protocol in which a remote attacker can trigger an out of bounds read with an offset of up to 64kB. This may panic the machine with a page-fault and the out-of-bounds data does not seem to be returned to the remote attacker.

For this attack to be sucessful, the kernel needs to have both the SCTP protocol module loaded and a process listening as an SCTP server.

Upstream patch:

https://github.com/torvalds/linux/commit/bf911e985d6bbaa328c20c3e05f4eb03de11fdd6

CVE assignment:

http://seclists.org/oss-sec/2016/q4/509

Last updated 24 July 2024