CVE-2023-53296

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: check send stream number after wait_for_sndbuf

This patch fixes a corner case where the asoc out stream count may change

after wait_for_sndbuf.

When the main thread in the client starts a connection, if its out stream

count is set to N while the in stream count in the server is set to N - 2,

another thread in the client keeps sending the msgs with stream number

N - 1, and waits for sndbuf before processing INIT_ACK.

However, after processing INIT_ACK, the out stream count in the client is

shrunk to N - 2, the same to the in stream count in the server. The crash

occurs when the thread waiting for sndbuf is awake and sends the msg in a

non-existing stream(N - 1), the call trace is as below:

KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]

Call Trace:

<TASK>

sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline]

sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References