AZL-90624

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

When a listening SCTP server processes a COOKIEECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctpprocessinit() using sctpwalk_params().

However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIEECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATECOOKIE processing and kmemdup() copies).

Add a bounds check in sctpunpackcookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.