From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9417C1F151B for ; Tue, 21 Jan 2025 12:09:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737461364; cv=none; b=AfVnRJcFNiOhbhVdw34SxXB6kTEBEnZpF1UyWTtGijNMuMli0HkP/C2ouHE41vYL2LyIfKwMwz1NUoDUjOM4LI8L1vAwGTzDcTNACkVwJ+N2HvESqvz219Jlm11vCtISU4uKT1EOcx3nOL2jXgzF54iQuIAVo9e4miaL+EPLbek= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737461364; c=relaxed/simple; bh=4JHbpR8vQhiKymEqqZdFWL7+f1zOwXJ1m2AhS/zBKFw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ICwL+wTqSVnqa1BOS+ahJX6q/E42ZCMVbZNAElg7UhskY5P8O/inAEcuDsbxuPmQqX61Y7sdg1JSgpZqMYio+yEqlfC6o2tkebVIkSW5ggUimzG/3n237W5rmSYYMF32+nZuNJdxN12Vtj3wLfoot+wYvREJ/2NoC66FrGbLs8k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wxzeRs1S; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="wxzeRs1S" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9DED2C4CEDF; Tue, 21 Jan 2025 12:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1737461364; bh=4JHbpR8vQhiKymEqqZdFWL7+f1zOwXJ1m2AhS/zBKFw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=wxzeRs1S6n07Sj3aC4qffManUih0pcm78KAERmYXraW459ECgZM8mHJgSQAITUYQf jDbRHu9TZV089sCZNYlX91jRI/H9dQsYlBqrVkjzEpF1yKf+Mmcl2c/MvBPtr+LjMy Fe2C5UDqStHOyYhkAfsIm4s9elGX9MuRm1gYvOpg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-57938: net/sctp: Prevent autoclose integer overflow in sctp_association_init() Date: Tue, 21 Jan 2025 13:09:21 +0100 Message-ID: <2025012119-CVE-2024-57938-eaa0@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3106; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=4JHbpR8vQhiKymEqqZdFWL7+f1zOwXJ1m2AhS/zBKFw=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn9fQXPG6QXzFCQPrlKMftvXdvF2W6HZR/8v+P+fk3u8 /+eqW6JHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR0z0MC2b9tvxxp9Dn293D Gyo/aGgsEH3zZj/DgrPvnuZLfF3OqTp91g+t90fYE16uZwUA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow. The Linux kernel CVE team has assigned CVE-2024-57938 to this issue. Affected and fixed versions =========================== Issue introduced in 3.13 with commit 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c and fixed in 5.4.289 with commit 94b7ed0a4896420988e1776942f0a3f67167873e Issue introduced in 3.13 with commit 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c and fixed in 5.10.233 with commit 081bdb3a31674339313c6d702af922bc29de2c53 Issue introduced in 3.13 with commit 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c and fixed in 5.15.176 with commit f9c3adb083d3278f065a83c3f667f1246c74c31f Issue introduced in 3.13 with commit 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c and fixed in 6.1.124 with commit 7af63ef5fe4d480064eb22583b24ffc8b408183a Issue introduced in 3.13 with commit 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c and fixed in 6.6.70 with commit 271f031f4c31c07e2a85a1ba2b4c8e734909a477 Issue introduced in 3.13 with commit 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c and fixed in 6.12.9 with commit 2297890b778b0e7c8200d6818154f7e461d78e94 Issue introduced in 3.13 with commit 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c and fixed in 6.13 with commit 4e86729d1ff329815a6e8a920cb554a1d4cb5b8d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-57938 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/sctp/associola.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/94b7ed0a4896420988e1776942f0a3f67167873e https://git.kernel.org/stable/c/081bdb3a31674339313c6d702af922bc29de2c53 https://git.kernel.org/stable/c/f9c3adb083d3278f065a83c3f667f1246c74c31f https://git.kernel.org/stable/c/7af63ef5fe4d480064eb22583b24ffc8b408183a https://git.kernel.org/stable/c/271f031f4c31c07e2a85a1ba2b4c8e734909a477 https://git.kernel.org/stable/c/2297890b778b0e7c8200d6818154f7e461d78e94 https://git.kernel.org/stable/c/4e86729d1ff329815a6e8a920cb554a1d4cb5b8d