Description

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays. A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain. Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T15:16:54.270Z",
  "pubdate": "2026-08-26T15:16:54.270Z",
  "executiveSummary": "The Linux kernel SCTP implementation contains an input validation vulnerability within the COOKIE_ECHO processing logic. This flaw allows a remote attacker to trigger out-of-bounds (OOB) memory reads and memory corruption by providing a crafted COOKIE_ECHO chunk when cookie authentication is disabled.\nThe vulnerability type is categorized as Improper Input Validation, leading to buffer overflows and OOB memory access. Successful exploitation can result in local privilege escalation (LPE) or kernel-level information disclosure, depending on the memory layout and the nature of the forged data.\nThe affected component is the Linux kernel SCTP stack. Attackers must be able to send SCTP packets to a target system to trigger the vulnerable code path. The risk is considered high due to the potential for privilege escalation and kernel corruption. No specific authentication is required, as the vulnerability is triggered during the SCTP association establishment phase, before full authentication is established.\nRemediation requires applying the kernel patch that enforces strict length and identifier validation against the local backing arrays before any cookie parameters are processed or copied into the association state.",
  "technicalDetails": "The vulnerability originates in the SCTP (Stream Control Transmission Protocol) stack of the Linux kernel, specifically within the COOKIE_ECHO chunk handling routine. When cookie authentication is disabled, the kernel incorrectly trusts the contents of the peer-controlled cookie bytes during the restoration of fixed-size AUTH fields.\nThe root cause is the failure to validate the lengths and contents of the RANDOM, HMAC list, and CHUNKS parameters provided within the cookie. The kernel directly copies these peer-controlled parameters into the association structure without ensuring they conform to expected boundaries or local capability constraints.\nExploitation involves an attacker crafting a malicious COOKIE_ECHO chunk containing manipulated length fields or unsupported parameter identifiers. For instance, a forged RANDOM length can induce an out-of-bounds read during the key-vector construction process, potentially leaking sensitive kernel memory or causing a kernel panic. Furthermore, supplying a forged HMAC identifier allows an attacker to trigger an out-of-bounds write of 32 bytes past a zero-length AUTH chunk. This memory corruption provides a functional primitive that can be leveraged to overwrite adjacent kernel data structures, facilitating an escalation of privileges.\nThe attack flow follows these steps: 1. An attacker sends a forged SCTP COOKIE_ECHO chunk to the target. 2. The kernel's SCTP stack receives the chunk while cookie authentication is disabled. 3. The vulnerable code blindly copies the malicious RANDOM, HMAC, and CHUNKS fields from the packet into the local association structure. 4. The kernel proceeds to use these unchecked values in security-critical operations, such as key-vector construction or AUTH chunk processing. 5. If a forged HMAC identifier is used, the kernel performs an unauthorized 32-byte write to heap memory. 6. By strategically controlling the memory state, the attacker exploits this write primitive to redirect execution flow or elevate privileges.\nThe flaw affects any system where the Linux kernel's SCTP implementation is active and configured in a state where COOKIE_ECHO processing does not undergo strict validation. As this code handles network input at the protocol level, it is reachable by any entity capable of sending SCTP packets to the host, requiring no prior authentication. The post-exploitation impact is severe, potentially compromising the integrity and availability of the kernel."
}