CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically in the `sctp_auth_ep_add_chunkid()` function, which improperly allows more than 16 authentication chunk entries to be added, leading to a potential buffer overflow. This can result in memory corruption, which may be exploited to execute arbitrary code or crash the system. Organizations using Linux systems that rely on SCTP should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes. Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.