[PATCH net] sctp: validate embedded INIT chunk and address list lengths in cookie

[PATCH net] sctp: validate embedded INIT chunk and address list lengths in cookie

[Xin Long]

sctp_unpack_cookie() only checked that the embedded INIT chunk length
did not exceed the remaining cookie payload, but did not ensure that the
INIT chunk is large enough to contain a complete INIT header.

A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose
length field is smaller than sizeof(struct sctp_init_chunk).  Later,
sctp_process_init() accesses INIT parameters unconditionally, which may
lead to out-of-bounds reads.

In addition, raw_addr_list_len is not fully validated against the
remaining cookie payload. When cookie authentication is disabled, an
attacker can supply an oversized raw_addr_list_len and cause
sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The
address parser also lacks sufficient bounds checks for parameter headers
and lengths, allowing malformed address parameters to trigger
out-of-bounds reads.

Fix this by:

- requiring the embedded INIT chunk length to be at least sizeof(struct
  sctp_init_chunk);
- validating that the INIT chunk and raw address list together fit
  within the cookie payload;
- verifying sufficient data exists for each address parameter header and
  payload before parsing it.

Note that sctp_verify_init() must be called after sctp_unpack_cookie()
and before sctp_process_init() when cookie authentication is disabled.
This will be addressed in a separate patch.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
 net/sctp/bind_addr.c     | 11 ++++++++++-
 net/sctp/sm_make_chunk.c |  9 +++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 75e3e61d494e..31737f144c7f 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -275,6 +275,16 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
 		param = (struct sctp_paramhdr *)raw_addr_list;
 		rawaddr = (union sctp_addr_param *)raw_addr_list;
 
+		if (addrs_len < sizeof(*param)) {
+			retval = -EINVAL;
+			goto out_err;
+		}
+		len = ntohs(param->length);
+		if (addrs_len < len) {
+			retval = -EINVAL;
+			goto out_err;
+		}
+
 		af = sctp_get_af_specific(param_type2af(param->type));
 		if (unlikely(!af) ||
 		    !af->from_addr_param(&addr, rawaddr, htons(port), 0)) {
@@ -291,7 +301,6 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
 			goto out_err;
 
 next:
-		len = ntohs(param->length);
 		addrs_len -= len;
 		raw_addr_list += len;
 	}
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 85264862fb6b..1741a9f33d8c 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1731,8 +1731,8 @@ struct sctp_association *sctp_unpack_cookie(
 	struct sk_buff *skb = chunk->skb;
 	struct sctp_cookie *bear_cookie;
 	struct sctp_chunkhdr *ch;
+	unsigned int len, chlen;
 	enum sctp_scope scope;
-	unsigned int len;
 	ktime_t kt;
 
 	/* Header size is static data prior to the actual cookie, including
@@ -1761,7 +1761,12 @@ struct sctp_association *sctp_unpack_cookie(
 	bear_cookie = &cookie->c;
 
 	ch = (struct sctp_chunkhdr *)(bear_cookie + 1);
-	if (ntohs(ch->length) > len - fixed_size)
+	chlen = ntohs(ch->length);
+	if (chlen < sizeof(struct sctp_init_chunk))
+		goto malformed;
+	if (chlen > len - fixed_size)
+		goto malformed;
+	if (bear_cookie->raw_addr_list_len > len - fixed_size - chlen)
 		goto malformed;
 
 	/* Verify the cookie's MAC, if cookie authentication is enabled. */
-- 
2.47.1

Re: [PATCH net] sctp: validate embedded INIT chunk and address list lengths in cookie

[Xin Long]

On Sun, Jun 7, 2026 at 7:03 PM Xin Long <lucien.xin@gmail.com> wrote:
>
> sctp_unpack_cookie() only checked that the embedded INIT chunk length
> did not exceed the remaining cookie payload, but did not ensure that the
> INIT chunk is large enough to contain a complete INIT header.
>
> A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose
> length field is smaller than sizeof(struct sctp_init_chunk).  Later,
> sctp_process_init() accesses INIT parameters unconditionally, which may
> lead to out-of-bounds reads.
>
> In addition, raw_addr_list_len is not fully validated against the
> remaining cookie payload. When cookie authentication is disabled, an
> attacker can supply an oversized raw_addr_list_len and cause
> sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The
> address parser also lacks sufficient bounds checks for parameter headers
> and lengths, allowing malformed address parameters to trigger
> out-of-bounds reads.
>
> Fix this by:
>
> - requiring the embedded INIT chunk length to be at least sizeof(struct
>   sctp_init_chunk);
> - validating that the INIT chunk and raw address list together fit
>   within the cookie payload;
> - verifying sufficient data exists for each address parameter header and
>   payload before parsing it.
>
> Note that sctp_verify_init() must be called after sctp_unpack_cookie()
> and before sctp_process_init() when cookie authentication is disabled.
> This will be addressed in a separate patch.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
> ---
>  net/sctp/bind_addr.c     | 11 ++++++++++-
>  net/sctp/sm_make_chunk.c |  9 +++++++--
>  2 files changed, 17 insertions(+), 3 deletions(-)
>
> diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
> index 75e3e61d494e..31737f144c7f 100644
> --- a/net/sctp/bind_addr.c
> +++ b/net/sctp/bind_addr.c
> @@ -275,6 +275,16 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
>                 param = (struct sctp_paramhdr *)raw_addr_list;
>                 rawaddr = (union sctp_addr_param *)raw_addr_list;
>
> +               if (addrs_len < sizeof(*param)) {
> +                       retval = -EINVAL;
> +                       goto out_err;
> +               }
> +               len = ntohs(param->length);
> +               if (addrs_len < len) {
> +                       retval = -EINVAL;
> +                       goto out_err;
> +               }
> +
>                 af = sctp_get_af_specific(param_type2af(param->type));
>                 if (unlikely(!af) ||
>                     !af->from_addr_param(&addr, rawaddr, htons(port), 0)) {
> @@ -291,7 +301,6 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
>                         goto out_err;
>
>  next:
> -               len = ntohs(param->length);
>                 addrs_len -= len;
>                 raw_addr_list += len;
>         }
> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
> index 85264862fb6b..1741a9f33d8c 100644
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -1731,8 +1731,8 @@ struct sctp_association *sctp_unpack_cookie(
>         struct sk_buff *skb = chunk->skb;
>         struct sctp_cookie *bear_cookie;
>         struct sctp_chunkhdr *ch;
> +       unsigned int len, chlen;
>         enum sctp_scope scope;
> -       unsigned int len;
>         ktime_t kt;
>
>         /* Header size is static data prior to the actual cookie, including
> @@ -1761,7 +1761,12 @@ struct sctp_association *sctp_unpack_cookie(
>         bear_cookie = &cookie->c;
>
>         ch = (struct sctp_chunkhdr *)(bear_cookie + 1);
> -       if (ntohs(ch->length) > len - fixed_size)
> +       chlen = ntohs(ch->length);
> +       if (chlen < sizeof(struct sctp_init_chunk))
> +               goto malformed;
> +       if (chlen > len - fixed_size)
> +               goto malformed;
> +       if (bear_cookie->raw_addr_list_len > len - fixed_size - chlen)
>                 goto malformed;
>
>         /* Verify the cookie's MAC, if cookie authentication is enabled. */
> --
> 2.47.1
>
Note in:
https://sashiko.dev/#/patchset/75af23a89adf881a0895d511775e4770da367cbf.1780873427.git.lucien.xin%40gmail.com

- Pre-existing issue 1: as mentioned in the commit message, it will be
  handled in a separate patch.

- Pre-existing issue 2: I don’t think it causes a problem. Also the normal
  address parameter is already 4-byte aligned, so SCTP_PAD4(len) is not
  needed either.

Re: [PATCH net] sctp: validate embedded INIT chunk and address list lengths in cookie

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun,  7 Jun 2026 19:03:47 -0400 you wrote:
> sctp_unpack_cookie() only checked that the embedded INIT chunk length
> did not exceed the remaining cookie payload, but did not ensure that the
> INIT chunk is large enough to contain a complete INIT header.
> 
> A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose
> length field is smaller than sizeof(struct sctp_init_chunk).  Later,
> sctp_process_init() accesses INIT parameters unconditionally, which may
> lead to out-of-bounds reads.
> 
> [...]

Here is the summary with links:
  - [net] sctp: validate embedded INIT chunk and address list lengths in cookie
    https://git.kernel.org/netdev/net/c/6f4c80a2a7e6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html