Vulnerability CVE-2013-1828: Information
Description
The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| usbip | sisyphus | 5.10-alt1 | 5.10-alt1 | ALT-PU-2023-1798-1 | 320453 | Fixed |
| usbip | p10 | 5.10-alt1 | 5.10-alt1 | ALT-PU-2023-1903-1 | 320461 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| http://twitter.com/grsecurity/statuses/309805924749541376 |
|
| https://bugzilla.redhat.com/show_bug.cgi?id=919315 |
|
| http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4 |
|
| http://grsecurity.net/~spender/sctp.c |
|
| [oss-security] 20130307 Re: CVE Request -- Linux kernel: sctp: SCTP_GET_ASSOC_STATS stack overflow |
|
| https://github.com/torvalds/linux/commit/726bc6b092da4c093eb74d13c07184b18c1af0f1 |
|
| 24747 |
|
| http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=726bc6b092da4c093eb74d13c07184b18c1af0f1 |
|