From: Xin Long lucien.xin@gmail.com
mainline inclusion from mainline commit 4f7019c7eb33967eb87766e0e4602b5576873680 bugzilla: 182989 https://gitee.com/openeuler/kernel/issues/I4DDEL CVE: CVE-2021-3772
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
Currently Linux SCTP uses the verification tag of the existing SCTP asoc when failing to process and sending the packet with the ABORT chunk. This will result in the peer accepting the ABORT chunk and removing the SCTP asoc. One could exploit this to terminate a SCTP asoc.
This patch is to fix it by always using the initiate tag of the received INIT chunk for the ABORT chunk to be sent.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long lucien.xin@gmail.com Acked-by: Marcelo Ricardo Leitner marcelo.leitner@gmail.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Chen Jun chenjun102@huawei.com Reviewed-by: Yue Haibing yuehaibing@huawei.com Reviewed-by: weiyang wang wangweiyang2@huawei.com
Signed-off-by: Chen Jun chenjun102@huawei.com --- net/sctp/sm_statefuns.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index b65bdaa84228..89a86728184d 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -6248,6 +6248,7 @@ static struct sctp_packet *sctp_ootb_pkt_new( * yet. */ switch (chunk->chunk_hdr->type) { + case SCTP_CID_INIT: case SCTP_CID_INIT_ACK: { struct sctp_initack_chunk *initack;