Published: 01/08/2014 Updated: 19/05/2023

CVSS v2 Base Score: 7.1 | Impact Score: 6.9 | Exploitability Score: 8.6

VMScore: 633

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C

The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel up to and including 3.15.8, when SCTP authentication is enabled, allows remote malicious users to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
suse linux enterprise desktop 11
suse linux enterprise server 11
suse linux enterprise real time extension 11
redhat enterprise linux server aus 6.2
redhat enterprise linux server aus 6.5
redhat enterprise linux server tus 6.5
redhat enterprise linux eus 6.5
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04

Several security issues were fixed in the kernel ...

A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts A remote attacker could use this flaw to crash the system ...

CWE-476 http://www.openwall.com/lists/oss-security/2014/07/26/1 https://bugzilla.redhat.com/show_bug.cgi?id=1122982 https://github.com/torvalds/linux/commit/1be9a950c646c9092fb3618197f7b6bfb50e82aa http://secunia.com/advisories/59777 http://secunia.com/advisories/60564 http://rhn.redhat.com/errata/RHSA-2014-1083.html http://www.ubuntu.com/usn/USN-2358-1 http://www.ubuntu.com/usn/USN-2334-1 http://www.ubuntu.com/usn/USN-2335-1 http://www.ubuntu.com/usn/USN-2359-1 http://secunia.com/advisories/60744 http://rhn.redhat.com/errata/RHSA-2014-1668.html http://rhn.redhat.com/errata/RHSA-2014-1763.html http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html http://secunia.com/advisories/62563 http://www.securitytracker.com/id/1030681 http://www.securityfocus.com/bid/68881 http://secunia.com/advisories/60545 http://secunia.com/advisories/60430 https://exchange.xforce.ibmcloud.com/vulnerabilities/95134 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1be9a950c646c9092fb3618197f7b6bfb50e82aa https://nvd.nist.gov https://usn.ubuntu.com/2358-1/https://access.redhat.com/security/cve/cve-2014-5077

CVE-2014-5077

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect