CVE-2010-3705

Published: 1 October 2010

The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.

From the Ubuntu Security Team

Dan Rosenberg discovered that SCTP did not correctly handle HMAC calculations. A remote attacker could send specially crafted traffic that would crash the system, leading to a denial of service.

Priority

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Released (2.6.24-28.80)
	jaunty	Released (2.6.28-19.66)
	karmic	Released (2.6.31-22.67)
	lucid	Released (2.6.32-25.45)
	maverick	Released (2.6.35-22.35)
	upstream	Needed
	Patches: proposed: http://marc.info/?l=linux-kernel&m=128596992418814&w=2 hardy: http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3705/patches/hardy/linux/0001-Fix-out-of-bounds-reading-in-sctp_asoc_get_hmac.txt jaunty: http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3705/patches/jaunty/linux/0001-Fix-out-of-bounds-reading-in-sctp_asoc_get_hmac.txt karmic: http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3705/patches/karmic/linux/0001-Fix-out-of-bounds-reading-in-sctp_asoc_get_hmac.txt lucid: http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3705/patches/lucid/linux/0001-Fix-out-of-bounds-reading-in-sctp_asoc_get_hmac.txt maverick: http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3705/patches/maverick/linux/0001-Fix-out-of-bounds-reading-in-sctp_asoc_get_hmac.txt
linux-ec2 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Released (2.6.31-307.21)
	lucid	Released (2.6.32-309.18)
	maverick	Ignored (end of life)
	upstream	Needs triage
linux-fsl-imx51 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Released (2.6.31-112.30)
	lucid	Released (2.6.31-608.22)
	maverick	Does not exist
	upstream	Needs triage
linux-lts-backport-maverick Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Does not exist
	lucid	Released (2.6.35-25.44~lucid1)
	maverick	Does not exist
	upstream	Needs triage
linux-mvl-dove Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Ignored (end of life)
	lucid	Released (2.6.32-216.33)
	maverick	Released (2.6.32-416.33)
	upstream	Needs triage
linux-source-2.6.15 Launchpad, Ubuntu, Debian	dapper	Not vulnerable
	hardy	Does not exist
	jaunty	Does not exist
	karmic	Does not exist
	lucid	Does not exist
	maverick	Does not exist
	upstream	Not vulnerable
linux-ti-omap4 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Does not exist
	lucid	Does not exist
	maverick	Released (2.6.35-903.22)
	upstream	Needs triage

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›