CVE-2013-2206

Published: 21 June 2013

The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.

From the Ubuntu security team

A flaw was discovered in the SCTP (stream control transfer protocol) network protocol's handling of duplicate cookies in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (system crash) on another remote user querying the SCTP connection.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2206
• https://ubuntu.com/security/notices/USN-1812-1
• https://ubuntu.com/security/notices/USN-1811-1
• https://ubuntu.com/security/notices/USN-1809-1
• https://ubuntu.com/security/notices/USN-1814-1
• https://ubuntu.com/security/notices/USN-1813-1
• https://ubuntu.com/security/notices/USN-1940-1
• https://ubuntu.com/security/notices/USN-1939-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=976562
• https://launchpad.net/bugs/1194445