CVE-2024-0639
published 2024-01-17CVE-2024-0639: A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.16%
5.7th percentile
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux_kernel | <= 6.4.16 | — |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 0 < 4.15.0-224.236 | 4.15.0-224.236 |
| msrc | cbl2_kernel_5.15.148.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.180.1-1_on_cbl_mariner_2.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-04-19·CVSS 4.7
CVE-2024-23851 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Wei Chen discovered that a race condition existed in the TIPC protocol
implementation in the Linux kernel, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-1382)
It was discovered that the virtio network implementation in the Linux
kernel did not properly handle file references in the host, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly expose sensitive information
(kernel memory). (CVE-2023-1838)
Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2
mitigations with prctl syscall were insufficient
Microsoft
Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos
vendor_msrc·2024-01-09·CVSS 5.5
CVE-2024-0639 [MEDIUM] CWE-667 Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos
Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference
Debian
CVE-2024-0639: linux - A denial of service vulnerability due to a deadlock was found in sctp_auto_ascon...
vendor_debian·2024·CVSS 5.5
CVE-2024-0639 [MEDIUM] CVE-2024-0639: linux - A denial of service vulnerability due to a deadlock was found in sctp_auto_ascon...
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
Scope: local
bookworm: resolved (fixed in 6.1.52-1)
bullseye: resolved (fixed in 5.10.191-1)
forky: resolved (fixed in 6.4.4-1)
sid: resolved (fixed in 6.4.4-1)
trixie: resolved (fixed in 6.4.4-1)
Red Hat
kernel: potential deadlock on &net->sctp.addr_wq_lock leading to DOS
vendor_redhat·2023-06-27·CVSS 5.5
CVE-2024-0639 [MEDIUM] CWE-833 kernel: potential deadlock on &net->sctp.addr_wq_lock leading to DOS
kernel: potential deadlock on &net->sctp.addr_wq_lock leading to DOS
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installat
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
osv·2024-04-19·CVSS 4.7
CVE-2023-1382 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
Wei Chen discovered that a race condition existed in the TIPC protocol
implementation in the Linux kernel, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2023-1382)
It was discovered that the virtio network implementation in the Linux
kernel did not properly handle file references in the host, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly expose sensitive information
(kernel memory). (CVE-2023-1838)
Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2
mitigati
OSV
CVE-2024-0639: A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket
osv·2024-01-17·CVSS 5.5
CVE-2024-0639 [MEDIUM] CVE-2024-0639: A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
GHSA
GHSA-668p-x3m7-8w6v: A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket
ghsa_unreviewed·2024-01-17
CVE-2024-0639 [MEDIUM] CWE-667 GHSA-668p-x3m7-8w6v: A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/security/cve/CVE-2024-0639https://bugzilla.redhat.com/show_bug.cgi?id=2258754https://github.com/torvalds/linux/commit/6feb37b3b06e9049e20dcf7e23998f92c9c5be9ahttps://access.redhat.com/security/cve/CVE-2024-0639https://bugzilla.redhat.com/show_bug.cgi?id=2258754https://github.com/torvalds/linux/commit/6feb37b3b06e9049e20dcf7e23998f92c9c5be9a
2024-01-17
Published