Description A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.
CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Exploitability: 2.2 | Impact: 4.2 Attack Vector: Network
Complexity: High
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: High
Affected Packages7 packages Show 2 more packages Also affects: Debian Linux 10.0, 9.0, Enterprise Linux 8.0
🔴 Vulnerability Details5 GHSA GHSA-g6gr-2x73-gj6f: A flaw was found in the Linux SCTP stack ↗ 2022-03-04 ▶ CVEList CVE-2021-3772: A flaw was found in the Linux SCTP stack ↗ 2022-03-02 ▶ OSV CVE-2021-3772: A flaw was found in the Linux SCTP stack ↗ 2022-03-02 ▶ OSV linux-oem-5.14 vulnerabilities ↗ 2021-11-30 ▶ Kernel Merge branch 'sctp-enhancements-for-the-verification-tag' ↗ 2021-10-22 ▶
📋 Vendor Advisories10 Ubuntu Linux kernel (AWS) vulnerabilities ↗ 2023-04-12 ▶ Ubuntu Linux kernel vulnerabilities ↗ 2023-04-12 ▶ Ubuntu Linux kernel (AWS) vulnerabilities ↗ 2023-04-06 ▶ Ubuntu Linux kernel vulnerabilities ↗ 2022-06-08 ▶ Ubuntu Linux kernel vulnerabilities ↗ 2022-06-08 ▶ Show 5 more
📄 Research Papers1 arXiv A Formal Analysis of SCTP: Attack Synthesis and Patch Verification ↗ 2024-03-08 ▶