18 matches found
CVE-2020-6514
CVE-2020-6514 漏洞利用 在编写漏洞利用时，我最初通过修改 WebRTC 源码并重新编译，改变了发送到目标设备的 SCTP 数据包。这对于攻击闭源应用并不实用，因此我最终改用 Frida 来 Hook 攻击设备的二进制程序。Frida 的 Hook 功能允许在特定原生函数调用前后执行代码，这使得我的漏洞利用能够修改外发的 SCTP 数据包，并检查传入的数据包。从功能上讲，这与修改攻击客户端的源代码等效，但修改不是在编译时在源代码中进行的，而是在运行时由 Frida 动态完成的。漏洞利用的源代码可在此处获取。 攻击设备需要 Hook 以下七个函数。 usrsctpconninp...
EUVD-2026-76384
In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctprcv resolves the transport once per packet and leaves it in chunk-transport. The lookup reference, or the one sctpaddbacklog takes if the socket is owned by userspace, keeps it...
EUVD-2026-64523
In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...
GHSA-2QJ4-MMR9-4V2F Netty: Memory Exhaustion in SctpMessageCompletionHandler
Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments. Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP...
Netty: Memory Exhaustion in SctpMessageCompletionHandler
Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments. Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP...
SUSE CVE-2025-40281
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctptransportupdaterto syzbot reported a possible shift-out-of-bounds 1 Blamed commit added rtoalphamax and rtobetamax set to 1000. It is unclear if some sctp users are setting very...
CVE-2025-40281
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctptransportupdaterto syzbot reported a possible shift-out-of-bounds 1 Blamed commit added rtoalphamax and rtobetamax set to 1000. It is unclear if some sctp users are setting very...
CVE-2025-40281
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctptransportupdaterto syzbot reported a possible shift-out-of-bounds 1 Blamed commit added rtoalphamax and rtobetamax set to 1000. It is unclear if some sctp users are setting very...
CVE-2025-40281
In the Linux kernel, CVE-2025-40281 affects SCTP in net/sctp/transport.c, where a shift-out-of-bounds could occur in sctp_transport_update_rto if rto_alpha_max/rto_beta_max were very large. The fix adds a run-time test to prevent regressions and includes READ_ONCE() annotations since sysctl value...
CVE-2025-40281 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctptransportupdaterto syzbot reported a possible shift-out-of-bounds 1 Blamed commit added rtoalphamax and rtobetamax set to 1000. It is unclear if some sctp users are setting very...
CVE-2025-40281 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctptransportupdaterto syzbot reported a possible shift-out-of-bounds 1 Blamed commit added rtoalphamax and rtobetamax set to 1000. It is unclear if some sctp users are setting very...
CVE-2025-40281
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctptransportupdaterto syzbot reported a possible shift-out-of-bounds 1 Blamed commit added rtoalphamax and rtobetamax set to 1000. It is unclear if some sctp users are setting very...
kernel: sctp: linearize cloned gso packets in sctp_rcv
A flaw use of uninitialized memory uncontrolled and invisible by attacker in the Linux kernel SCTP transport protocol was found in the way user triggers malicious SCTP packets. A remote user could use this flaw to crash the system. The bug actual only for systems where SCTP protocol being enabled...
EUVD-2025-13103
Malicious code in bioql PyPI...
UBUNTU-CVE-2025-23142
In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctpsendmsg re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the message destination address, and then...
CVE-2025-23142 sctp: detect and prevent references to a freed transport in sendmsg
In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctpsendmsg re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the message destination address, and then...
CVE-2025-23142
CVE-2025-23142 details are not provided in the supplied documents; monitor for updates.
DEBIAN-CVE-2023-39193
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctpmtcheck did not validate the flagcount field. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read, leading to a crash or information disclosure...