CVE-2006-2275
published 2006-05-09CVE-2006-2275: Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver…
PriorityP429high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.60%
88.3th percentile
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to "spillover of the receive buffer."
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| lksctp | stream_control_transmission_protocol | < 2.6.17 | 2.6.17 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat7.5HIGH
vendor_ubuntu6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2006-06-15·CVSS 6.9
CVE-2006-1856 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
An integer overflow was discovered in the do_replace() function. A
local user process with the CAP_NET_ADMIN capability could exploit
this to execute arbitrary commands with full root privileges.
However, none of Ubuntu's supported packages use this capability with
any non-root user, so this only affects you if you use some third
party software like the OpenVZ virtualization system. (CVE-2006-0038)
On EMT64 CPUs, the kernel did not properly handle uncanonical return
addresses. A local user could exploit this to trigger a kernel crash.
(CVE-2006-0744)
Al Viro discovered a local Denial of Service in the sysfs write buffer
handling. By writing a block with a length exactly equal to the
processor's page size to any w
Red Hat
security flaw
vendor_redhat·2006-05-09·CVSS 7.5
CVE-2006-2275 [HIGH] security flaw
security flaw
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to "spillover of the receive buffer."
GHSA
GHSA-j2xg-37rj-vrf9: Linux SCTP (lksctp) before 2
ghsa_unreviewed·2022-05-01
CVE-2006-2275 [MEDIUM] CWE-667 GHSA-j2xg-37rj-vrf9: Linux SCTP (lksctp) before 2
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to "spillover of the receive buffer."
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-2275 security flaw
bugzilla·2018-08-16·CVSS 7.5
CVE-2006-2275 [HIGH] CVE-2006-2275 security flaw
CVE-2006-2275 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a receiver application that cannot process the messages quickly enough, which leads to "spillover of the receive buffer."
Bugzilla
CVE-2006-2275 SCTP receive buffer DoS
bugzilla·2006-05-10·CVSS 7.5
CVE-2006-2275 [HIGH] CVE-2006-2275 SCTP receive buffer DoS
CVE-2006-2275 SCTP receive buffer DoS
Linux SCTP before 2.6.17 allows remote attackers to cause a denial of service
via a large number of small messages to a receiver application that cannot
process the messages quickly enough, which leads to "spillover of the receive
buffer."
This issue hasn't been reproduced with RHEL4, but the vulnerable code is the
same as upstream.
The upstream fix can be found here:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5
Discussion:
*** This bug has been marked as a duplicate of 187494 ***
Bugzilla
CVE-2006-2275 SCTP traffic probably never resumes
bugzilla·2006-03-31·CVSS 7.5
CVE-2006-2275 [HIGH] CVE-2006-2275 SCTP traffic probably never resumes
CVE-2006-2275 SCTP traffic probably never resumes
Escalated to Bugzilla from IssueTracker
Discussion:
I'm getting to understand what going on here I think. It appears that we have
two problems:
1) Even though we are discarding frames due to lack of buffer space on the
receive side, we continue to ack them, constantly reopening our receive window.
2) When we fill our receive window, and then receive a frame, we immediately
fill it up again with the next packet that arrives, which we then discard, as
the chunks are bundled, making for a bigger packet that we much unilaterraly
accept or deny. This leads to a constant lack of reception of frames which
eventually leads to the sender giving up and sending an abort message
I think what I need to do here is write a patch that:
1) doesn't SAC
CWE
Deadlock
mitre_cwe·CVSS 2.1
[LOW] CWE-833 Deadlock
CWE-833: Deadlock
The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart. Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done
CWE
Improper Locking
mitre_cwe
CWE-667 Improper Locking
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: A
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5http://secunia.com/advisories/20716http://secunia.com/advisories/21465http://secunia.com/advisories/22417http://support.avaya.com/elmodocs2/security/ASA-2006-200.htmhttp://www.redhat.com/support/errata/RHSA-2006-0575.htmlhttp://www.securityfocus.com/bid/17955http://www.trustix.org/errata/2006/0026http://www.ubuntu.com/usn/usn-302-1https://exchange.xforce.ibmcloud.com/vulnerabilities/26433https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11295http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5http://secunia.com/advisories/20716http://secunia.com/advisories/21465http://secunia.com/advisories/22417http://support.avaya.com/elmodocs2/security/ASA-2006-200.htmhttp://www.redhat.com/support/errata/RHSA-2006-0575.htmlhttp://www.securityfocus.com/bid/17955http://www.trustix.org/errata/2006/0026http://www.ubuntu.com/usn/usn-302-1https://exchange.xforce.ibmcloud.com/vulnerabilities/26433https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11295
2006-05-09
Published