In the Linux kernel, the following vulnerability has been resolved:
sctp: check send stream number after waitforsndbuf
This patch fixes a corner case where the asoc out stream count may change after waitforsndbuf.
When the main thread in the client starts a connection, if its out stream count is set to N while the in stream count in the server is set to N - 2, another thread in the client keeps sending the msgs with stream number N - 1, and waits for sndbuf before processing INIT_ACK.
However, after processing INIT_ACK, the out stream count in the client is shrunk to N - 2, the same to the in stream count in the server. The crash occurs when the thread waiting for sndbuf is awake and sends the msg in a non-existing stream(N - 1), the call trace is as below:
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] Call Trace: <TASK> sctpcmdsendmsg net/sctp/smsideeffect.c:1114 [inline] sctpcmdinterpreter net/sctp/smsideeffect.c:1777 [inline] sctpsideeffects net/sctp/smsideeffect.c:1199 [inline] sctpdosm+0x197d/0x5310 net/sctp/smsideeffect.c:1170 sctpprimitiveSEND+0x9f/0xc0 net/sctp/primitive.c:163 sctpsendmsgtoasoc+0x10eb/0x1a30 net/sctp/socket.c:1868 sctpsendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026 inetsendmsg+0x9d/0xe0 net/ipv4/afinet.c:825 socksendmsgnosec net/socket.c:722 [inline] socksendmsg+0xde/0x190 net/socket.c:745
The fix is to add an unlikely check for the send stream number after the thread wakes up from the waitforsndbuf.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0443fff49d6352160c200064156c25898bd9f58c",
"id": "CVE-2023-53296-0aa45377",
"deprecated": false,
"target": {
"function": "sctp_sendmsg_to_asoc",
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"length": 2043.0,
"function_hash": "304746701870293558495826172818865142035"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2584024b23552c00d95b50255e47bd18d306d31a",
"id": "CVE-2023-53296-29b116cb",
"deprecated": false,
"target": {
"function": "sctp_sendmsg_to_asoc",
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"length": 2000.0,
"function_hash": "182584125830887050707134583484952400677"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2128636b303aa9cf065055402ee6697409a8837",
"id": "CVE-2023-53296-35ff6398",
"deprecated": false,
"target": {
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182574611157873067810282303556890547463",
"303990441971341250858490048176685279733",
"163005908090525570523998944496875933732",
"257705691862091024923222649130599619945"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@667eb99cf7c15fe5b0ecefe75cf658e20ef20c9f",
"id": "CVE-2023-53296-36c02de7",
"deprecated": false,
"target": {
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182574611157873067810282303556890547463",
"303990441971341250858490048176685279733",
"163005908090525570523998944496875933732",
"257705691862091024923222649130599619945"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9346a1a21142357972a6f466ba6275ddc54b04ac",
"id": "CVE-2023-53296-3c89e3cf",
"deprecated": false,
"target": {
"function": "sctp_sendmsg_to_asoc",
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"length": 2039.0,
"function_hash": "321201670360175593953387924993281089213"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4b6dfad41aaae9e36e44327b18d5cf4b20dd2ce",
"id": "CVE-2023-53296-6a4cfb8c",
"deprecated": false,
"target": {
"function": "sctp_sendmsg_to_asoc",
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"length": 2043.0,
"function_hash": "304746701870293558495826172818865142035"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2584024b23552c00d95b50255e47bd18d306d31a",
"id": "CVE-2023-53296-716f548d",
"deprecated": false,
"target": {
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182574611157873067810282303556890547463",
"303990441971341250858490048176685279733",
"163005908090525570523998944496875933732",
"257705691862091024923222649130599619945"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2128636b303aa9cf065055402ee6697409a8837",
"id": "CVE-2023-53296-7aa4b4e0",
"deprecated": false,
"target": {
"function": "sctp_sendmsg_to_asoc",
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"length": 2000.0,
"function_hash": "182584125830887050707134583484952400677"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a615e7270318fa0b98bf1ff38daf6cf52d840312",
"id": "CVE-2023-53296-8f737db4",
"deprecated": false,
"target": {
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182574611157873067810282303556890547463",
"303990441971341250858490048176685279733",
"163005908090525570523998944496875933732",
"257705691862091024923222649130599619945"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4b6dfad41aaae9e36e44327b18d5cf4b20dd2ce",
"id": "CVE-2023-53296-8fc8e55f",
"deprecated": false,
"target": {
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182574611157873067810282303556890547463",
"303990441971341250858490048176685279733",
"163005908090525570523998944496875933732",
"257705691862091024923222649130599619945"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9346a1a21142357972a6f466ba6275ddc54b04ac",
"id": "CVE-2023-53296-ca7ad15e",
"deprecated": false,
"target": {
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182574611157873067810282303556890547463",
"303990441971341250858490048176685279733",
"163005908090525570523998944496875933732",
"257705691862091024923222649130599619945"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0443fff49d6352160c200064156c25898bd9f58c",
"id": "CVE-2023-53296-d22ee204",
"deprecated": false,
"target": {
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182574611157873067810282303556890547463",
"303990441971341250858490048176685279733",
"163005908090525570523998944496875933732",
"257705691862091024923222649130599619945"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a615e7270318fa0b98bf1ff38daf6cf52d840312",
"id": "CVE-2023-53296-d2765474",
"deprecated": false,
"target": {
"function": "sctp_sendmsg_to_asoc",
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"length": 2000.0,
"function_hash": "182584125830887050707134583484952400677"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@667eb99cf7c15fe5b0ecefe75cf658e20ef20c9f",
"id": "CVE-2023-53296-d5ab5a3c",
"deprecated": false,
"target": {
"function": "sctp_sendmsg_to_asoc",
"file": "net/sctp/socket.c"
},
"signature_version": "v1",
"digest": {
"length": 2043.0,
"function_hash": "304746701870293558495826172818865142035"
},
"signature_type": "Function"
}
]