NVD Vulnerability Detail

CVE-2016-9555

Summary	The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
Publication Date	Nov. 28, 2016, 12:59 p.m.
Registration Date	Jan. 26, 2021, 2:20 p.m.
Last Update	Nov. 21, 2024, 12:01 p.m.

CVSS3.1 : CRITICAL
スコア	9.8
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	10.0
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:linux:linux_kernel::::::::	3.2			3.2.85
cpe:2.3:o:linux:linux_kernel::::::::	3.3			3.10.105
cpe:2.3:o:linux:linux_kernel::::::::	3.11			3.12.68
cpe:2.3:o:linux:linux_kernel::::::::	3.13			3.16.40
cpe:2.3:o:linux:linux_kernel::::::::	3.17			3.18.49
cpe:2.3:o:linux:linux_kernel::::::::	3.19			4.4.32
cpe:2.3:o:linux:linux_kernel::::::::	4.5.0			4.8.8

Related information, measures and tools

No	URL	タグ
1	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bf911e985d6bbaa328c20c3e05f4eb03de11fdd6	Issue Tracking Patch Vendor Advisory
2	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bf911e985d6bbaa328c20c3e05f4eb03de11fdd6	Issue Tracking Patch Vendor Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00044.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00044.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00054.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00054.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00055.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00055.html	Mailing List Third Party Advisory
9	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00056.html	Mailing List Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00056.html	Mailing List Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00067.html	Mailing List Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00067.html	Mailing List Third Party Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00070.html	Mailing List Third Party Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00070.html	Mailing List Third Party Advisory
15	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00073.html	Mailing List Third Party Advisory
16	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00073.html	Mailing List Third Party Advisory
17	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00076.html	Mailing List Third Party Advisory
18	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00076.html	Mailing List Third Party Advisory
19	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00077.html	Mailing List Third Party Advisory
20	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00077.html	Mailing List Third Party Advisory
21	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00087.html	Mailing List Third Party Advisory
22	http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00087.html	Mailing List Third Party Advisory
23	http://rhn.redhat.com/errata/RHSA-2017-0086.html	Third Party Advisory
24	http://rhn.redhat.com/errata/RHSA-2017-0086.html	Third Party Advisory
25	http://rhn.redhat.com/errata/RHSA-2017-0091.html	Third Party Advisory
26	http://rhn.redhat.com/errata/RHSA-2017-0091.html	Third Party Advisory
27	http://rhn.redhat.com/errata/RHSA-2017-0113.html	Third Party Advisory
28	http://rhn.redhat.com/errata/RHSA-2017-0113.html	Third Party Advisory
29	http://rhn.redhat.com/errata/RHSA-2017-0307.html	Third Party Advisory
30	http://rhn.redhat.com/errata/RHSA-2017-0307.html	Third Party Advisory
31	http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.8	Release Notes Vendor Advisory
32	http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.8	Release Notes Vendor Advisory
33	http://www.openwall.com/lists/oss-security/2016/11/22/18	Mailing List Third Party Advisory
34	http://www.openwall.com/lists/oss-security/2016/11/22/18	Mailing List Third Party Advisory
35	http://www.securityfocus.com/bid/94479	Third Party Advisory VDB Entry
36	http://www.securityfocus.com/bid/94479	Third Party Advisory VDB Entry
37	http://www.securitytracker.com/id/1037339	Third Party Advisory VDB Entry
38	http://www.securitytracker.com/id/1037339	Third Party Advisory VDB Entry
39	https://bto.bluecoat.com/security-advisory/sa134	Third Party Advisory
40	https://bto.bluecoat.com/security-advisory/sa134	Third Party Advisory
41	https://bugzilla.redhat.com/show_bug.cgi?id=1397930	Issue Tracking Third Party Advisory
42	https://bugzilla.redhat.com/show_bug.cgi?id=1397930	Issue Tracking Third Party Advisory
43	https://github.com/torvalds/linux/commit/bf911e985d6bbaa328c20c3e05f4eb03de11fdd6	Issue Tracking Patch Third Party Advisory
44	https://github.com/torvalds/linux/commit/bf911e985d6bbaa328c20c3e05f4eb03de11fdd6	Issue Tracking Patch Third Party Advisory
45	https://groups.google.com/forum/#%21topic/syzkaller/pAUcHsUJbjk
46	https://groups.google.com/forum/#%21topic/syzkaller/pAUcHsUJbjk

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html

JVN Vulnerability Information

Linux Kernel の net/sctp/sm_statefuns.c の sctp_sf_ootb 関数におけるサービス運用妨害 (DoS) の脆弱性

Title	Linux Kernel の net/sctp/sm_statefuns.c の sctp_sf_ootb 関数におけるサービス運用妨害 (DoS) の脆弱性
Summary	Linux Kernel の net/sctp/sm_statefuns.c の sctp_sf_ootb 関数は、最初のチャンクの長さの確認を欠いているため、サービス運用妨害 (境界外のスラブ (slab) アクセス) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。補足情報 : CWE による脆弱性タイプは、CWE-125: Out-of-bounds Read (境界外読み取り) と識別されています。 https://cwe.mitre.org/data/definitions/125.html
Possible impacts	リモートの攻撃者により、サービス運用妨害 (境界外のスラブ (slab) アクセス) 状態にされるなど、不特定の影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 15, 2016, midnight
Registration Date	Nov. 30, 2016, 3:49 p.m.
Last Update	Nov. 30, 2016, 3:49 p.m.

Affected System

Linux

Linux Kernel 4.8.8 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-9555	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9555
National Vulnerability Database (NVD)
2	CVE-2016-9555	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9555

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-Other	https://www.ipa.go.jp/security/vuln/CWE.html#CWEOther

ベンダー情報

No	Name	URL
ChangeLog
1	ChangeLog-4.8.8	https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.8
GitHub
2	sctp: validate chunk len before actually using it	https://github.com/torvalds/linux/commit/bf911e985d6bbaa328c20c3e05f4eb03de11fdd6
Google Groups
3	net/sctp: slab-out-of-bounds in sctp_sf_ootb	https://groups.google.com/forum/#!topic/syzkaller/pAUcHsUJbjk
Linux Kernel
4	Linux Kernel Archives	http://www.kernel.org
Linux kernel source tree
5	sctp: validate chunk len before actually using it	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bf911e985d6bbaa328c20c3e05f4eb03de11fdd6
Red Hat Bugzilla
6	Bug 1397930	https://bugzilla.redhat.com/show_bug.cgi?id=1397930

Change Log

No	Changed Details	Date of change
0	[2016年11月30日] 掲載	Feb. 17, 2018, 10:37 a.m.