In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp_asconf_queue_teardown() releases the cached chunk without clearing addip_last_asconf. During peer restart handling, sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes sctp_asconf_queue_teardown() whi…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb
- https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435
- https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33
- https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693
- https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21
- https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073
- https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d
- https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c
Timeline
- nvd_ingest NVD