Last updated 24 July 2024
An use after free flaw was found in the Linux kernel SCTP implementation handled auth keys reference counting during INIT collisions.
A remote user could use this flaw to crash the system or, though unlikely, escalate their privileges on the system.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=600ddd6825543962fb807884169e57b580dba208
Acknowledgements:
This issue was discovered by Sun Baoliang of Red Hat.
drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) ozusbrx and (2) ozusbhandleepdata functions.