CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically in the handling of socket locks during the connection establishment process. An attacker could exploit this race condition to manipulate socket associations, potentially leading to unauthorized access or data corruption. Organizations using Linux systems that rely on SCTP should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect() drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After re-acquiring the old socket lock, sctp_wait_for_connect() returns success without noticing the migration — the caller then accesses the association under the wrong lock in sctp_datamsg_from_user(). Add the same sk != asoc->base.sk check that sctp_wait_for_sndbuf() already has, returning an error if the association was migrated while we slept.