CVE-2024-57938

Summary

In the Linux kernel, the following vulnerability has been resolved:

net/sctp: Prevent autoclose integer overflow in sctp_association_init()

While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux9f70f46bd4c7267d48ef461a1d613ec9ec0d520c < 94b7ed0a4896420988e1776942f0a3f67167873eaffected
LinuxLinux9f70f46bd4c7267d48ef461a1d613ec9ec0d520c < 081bdb3a31674339313c6d702af922bc29de2c53affected
LinuxLinux9f70f46bd4c7267d48ef461a1d613ec9ec0d520c < f9c3adb083d3278f065a83c3f667f1246c74c31faffected
LinuxLinux9f70f46bd4c7267d48ef461a1d613ec9ec0d520c < 7af63ef5fe4d480064eb22583b24ffc8b408183aaffected
LinuxLinux9f70f46bd4c7267d48ef461a1d613ec9ec0d520c < 271f031f4c31c07e2a85a1ba2b4c8e734909a477affected
LinuxLinux9f70f46bd4c7267d48ef461a1d613ec9ec0d520c < 2297890b778b0e7c8200d6818154f7e461d78e94affected
LinuxLinux9f70f46bd4c7267d48ef461a1d613ec9ec0d520c < 4e86729d1ff329815a6e8a920cb554a1d4cb5b8daffected
LinuxLinux3.13affected
LinuxLinux0 < 3.13unaffected
LinuxLinux5.4.289 <= 5.4.*unaffected
LinuxLinux5.10.233 <= 5.10.*unaffected
LinuxLinux5.15.176 <= 5.15.*unaffected
LinuxLinux6.1.124 <= 6.1.*unaffected
LinuxLinux6.6.70 <= 6.6.*unaffected
LinuxLinux6.12.9 <= 6.12.*unaffected
LinuxLinux6.13 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References