| Summary: | Kernel: local privilege escalation due to use-after-free in "sctp_sendmsg()" (CVE-2019-8956) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Kernel | Assignee: | Gentoo Kernel Security <security-kernel> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | ||
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://www.openwall.com/lists/oss-security/2019/02/21/2 | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
Patch is in 4.19.21, 4.20.8, 5.0 |
From ${URL} : Secunia just announced this a local root in SCTP: https://secuniaresearch.flexerasoftware.com/secunia_research/2019-5/ There was a SCTP local root in the kernel due to a association list corruption. https://lore.kernel.org/netdev/20190201141522.GA20785@kroah.com/ In sctp_sendmesg(), when walking the list of endpoint associations, the association can be dropped from the list, making the list corrupt. Properly handle this by using list_for_each_entry_safe() Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") This issue is in 4.17 up to 5.0rc6.