In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 3.9
Impact Score: 3.6
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ac4ab00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a700940> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd340cc4b40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd385453400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ac48540> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36ac4acc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3842b4c80> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd385453740> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd341efa840> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd36ac481c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3e2d519c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3842b6b00> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3842b45c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7fd3842b4080> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* |