Files
linux/include/net
Xin Long e0b5252a59 sctp: fix auth_hmacs array size in struct sctp_cookie
The auth_hmacs array in struct sctp_cookie is supposed to store a complete
SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr
followed by N HMAC identifiers.

However, the array size was calculated using an extra 2 bytes instead of
sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers
are configured, the HMAC-ALGO parameter stored in the endpoint is larger
than the auth_hmacs buffer in the cookie.

As a result, sctp_association_init() copies beyond the end of auth_hmacs
when initializing the association, corrupting the adjacent auth_chunks
field. This can lead to an invalid HMAC identifier being accepted and later
cause an out-of-bounds read in sctp_auth_get_hmac().

Fix the array size calculation by including the full SCTP parameter header
size.

Fixes: 1f485649f5 ("[SCTP]: Implement SCTP-AUTH internals")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Reported-by: Zihan Xi <xizh2024@lzu.edu.cn>
Reported-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/634a0de0d5de29532915e6d47c92a0cbc206e03f.1783707155.git.lucien.xin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-17 12:27:53 +02:00
..
2025-04-24 17:03:45 -07:00
2025-07-08 18:05:25 -07:00
2026-05-21 13:04:42 +02:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2025-08-26 17:34:31 -07:00
2026-01-21 19:28:32 -08:00
2024-05-07 01:35:55 +02:00
2024-08-26 09:37:23 -07:00
2024-12-06 17:43:08 -08:00
2025-09-18 12:32:06 +02:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2025-04-11 18:58:10 -07:00
2025-07-04 09:32:35 +02:00
2024-05-30 18:29:38 -07:00
2025-09-08 18:06:21 -07:00
2025-07-11 11:00:57 -07:00
2026-03-13 18:57:44 -07:00
2026-04-06 18:43:51 -07:00
2026-03-16 19:28:21 -07:00