Description

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctp_verify_param() accepts a header-only parameter because the generic parameter walker only requires the header to be present. sctp_process_param() then reads adaptation_ind beyond the declared parameter. When the malformed parameter is last in an INIT, the read starts at the receive skb tail, and the value is copied into the state cookie returned in the INIT ACK. This may disclose four receive-buffer tail bytes. Require the declared parameter length to match the fixed structure size and abort the association through the existing invalid parameter length path otherwise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T08:16:57.430Z",
  "pubdate": "2026-08-28T08:16:57.430Z",
  "executiveSummary": "This vulnerability is an out-of-bounds read flaw within the SCTP protocol implementation of the Linux kernel.\nThe issue arises due to insufficient validation of the Adaptation Layer Indication parameter length during the SCTP handshake process.\nBy crafting a malformed INIT chunk, an attacker can force the kernel to read memory beyond the intended parameter boundary.\nThe vulnerability allows for the leakage of kernel memory, specifically trailing bytes of the receive buffer, which are subsequently exposed to the attacker via an INIT ACK response.\nThe risk is categorized as an information disclosure vulnerability, as it may reveal sensitive data from the kernel heap or network buffers.\nNo specific authentication or high-privilege access is required for exploitation; it can be triggered by any remote entity capable of initiating an SCTP connection to the target system.",
  "technicalDetails": "The root cause of the vulnerability lies in the validation logic within sctp_verify_param(). While the Adaptation Layer Indication parameter is defined to contain a fixed 32-bit Adaptation Code Point following its header, the generic parameter validation logic only verifies the presence of the header itself. This architectural oversight allows parameters with missing or truncated payloads to pass the initial verification stage.\nThe exploitation flow begins when the kernel processes an SCTP INIT chunk containing an Adaptation Layer Indication parameter that lacks the required 32-bit Adaptation Code Point. When the sctp_process_param() function attempts to parse this parameter, it performs an out-of-bounds read relative to the buffer containing the parameter. If this malformed parameter is placed at the end of the INIT chunk, the read operation extends into the memory immediately following the received skb (socket buffer) tail.\nThe retrieved value, which includes arbitrary bytes from the kernel memory adjacent to the receive buffer, is then copied into the state cookie structure. This cookie is returned to the initiator of the connection as part of the INIT ACK packet. Because the kernel treats these leaked bytes as legitimate data for the state cookie, the attacker can extract them from the response packet.\nThis behavior constitutes a localized information leak, potentially exposing sensitive kernel stack or heap data depending on the current state of the receive buffer. Because the vulnerability manifests during the initial phase of the SCTP handshake, the attack surface is exposed to any network entity capable of reaching the SCTP endpoint, requiring no prior authentication or administrative privileges.\nThe remediation involves enforcing strict length checks within the SCTP parameter parsing logic. By ensuring that the declared parameter length matches the fixed structure size (the header plus the 32-bit Adaptation Code Point), the kernel can identify malformed parameters during the verification phase and trigger the established error-handling path to abort the association before memory exposure occurs."
}