CVE-2014-0101

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields…

published March 11, 2014

CVSS
—
EPSS
7%
Percentile
94.2
In the wild
Unconfirmed
What it is

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07179 · 94.2th percentile
Published
2014-03-11T01:00Z
EPSS history
Timeline
  • 11 MAR 01:00Z
    The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields…
    cvelistv5