Bug 1226442 (CVE-2015-3212) - CVE-2015-3212 kernel: SCTP race condition allows list corruption and panic from userlevel
Summary: CVE-2015-3212 kernel: SCTP race condition allows list corruption and panic fr...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-3212
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1206474 1227960 1227961 1227962 1227963 1244665 1244666 1244684 1244692
Blocks: 1226448
TreeView+ depends on / blocked
 
Reported: 2015-05-29 19:20 UTC by Fabio Olive Leite
Modified: 2021-02-17 05:15 UTC (History)
21 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A race condition flaw was found in the way the Linux kernel's SCTP implementation handled Address Configuration lists when performing Address Configuration Change (ASCONF). A local attacker could use this flaw to crash the system via a race condition triggered by setting certain ASCONF options on a socket.
Clone Of:
Environment:
Last Closed: 2019-06-08 02:41:28 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1778 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2015-09-15 16:03:32 UTC
Red Hat Product Errata RHSA-2015:1787 0 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2015-09-15 13:22:07 UTC
Red Hat Product Errata RHSA-2015:1788 0 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2015-09-15 13:38:06 UTC

Description Fabio Olive Leite 2015-05-29 19:20:06 UTC 
A flaw was found in the Linux kernels handling of the SCTPs automatic handling of dynamic multi-homed connections.  A race condition in the way the Linux kernel handles lists of associations in SCTP sockets using Address Configuration Change messages, leading to list corruption and panics.

References:
http://marc.info/?l=linux-netdev&m=143277436124732&w=2

Commit:
https://git.kernel.org/linus/2d45a02d0166caf2627fe91897c6ffc3b19514c4
Comment 1 Wade Mealing 2015-06-02 12:37:31 UTC 
Acknowledgements:

This issue was discovered by Ji Jianwen of Red Hat Engineering.
Comment 4 Wade Mealing 2015-07-07 03:30:10 UTC 
Statement:

This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 5.

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2.
Comment 9 errata-xmlrpc 2015-09-15 09:23:43 UTC 
This issue has been addressed in the following products:

  MRG for RHEL-6 v.2

Via RHSA-2015:1787 https://rhn.redhat.com/errata/RHSA-2015-1787.html
Comment 10 errata-xmlrpc 2015-09-15 09:39:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1788 https://rhn.redhat.com/errata/RHSA-2015-1788.html
Comment 11 errata-xmlrpc 2015-09-15 12:07:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1778 https://rhn.redhat.com/errata/RHSA-2015-1778.html
Note You need to log in before you can comment on or make changes to this bug.