CVE-2014-5077

Linux Kernel 2.6.24-3.15.8 - Denial of Service via SCTP Association Update

Title source: llm
STIX 2.1

Description

The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

References (22)

Core 22
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60545
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62563
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2335-1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2334-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60430
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60564
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1083.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/07/26/1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2359-1
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1763.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59777
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1668.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/95134
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1030681
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2358-1
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1122982
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60744
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/68881

Scores

EPSS 0.1278
EPSS Percentile 94.1%

Details

CWE
CWE-476
Status published
Products (10)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
linux/linux_kernel 2.6.24 - 3.2.63
redhat/enterprise_linux_eus 6.5
redhat/enterprise_linux_server_aus 6.2
redhat/enterprise_linux_server_aus 6.5
redhat/enterprise_linux_server_tus 6.5
suse/linux_enterprise_desktop 11 sp3
suse/linux_enterprise_real_time_extension 11 sp3
suse/linux_enterprise_server 11 sp3 (2 CPE variants)
Published Aug 01, 2014
Tracked Since Feb 18, 2026