Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

sctp: validate embedded INIT chunk and address list lengths in cookie (Linux Linux)

CVE-2026-53224
CRITICAL 9.1

At a glance

Source
NVD
EPSS
EPSS 0.53 % · percentile 45 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Search on…

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch.

Weaknesses (CWE)

  • CWE-125 — Out-of-bounds Read

References

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HLinux
CVSS 3.1CRITICAL 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b1ca7dcfb335caa2c73d2d1bb5710e6dea2c11e0 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < dd75066882ecc4ec8df3f5384b4b9fa9579be8f0 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 29ab56e7660b6f849c10c46e87e085649df751eb ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7560afb8cddafd829e709d7ea09230e45a825557 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 512a9bb77c04ac9927648ea58af617e472be96e6 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6f4c80a2a7e6d06753b89a578b710a2499a5e62b
Linux · Linuxaffected 2.6.12 ; unaffected 0 < 2.6.12 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.36 ≤ 6.18.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD