CVE-2008-4445

CVE-2008-4445 affects the Linux kernel SCTP implementation prior to 2.6.26.4. The vulnerability resides in sctp_auth_ep_set_hmacs (net/sctp/auth.c) where the identifier index is not validated against SCTP_AUTH_HMAC_ID_MAX when SCTP-AUTH is enabled. This can allow local users to obtain sensitive i...

CVE-2008-4113

The vulnerability CVE-2008-4113 affects the Linux kernel prior to 2.6.26.4 with SCTP-AUTH enabled. In sctp_getsockopt_hmac_ident (net/sctp/socket.c), an untrusted length value is used to bound data copied from kernel memory, allowing a local unprivileged user to disclose sensitive kernel memory c...