[PATCH 0/4][SRU][X] CVE-2019-3874 - SCTP Denial of Service

Tyler Hicks tyhicks at canonical.com
Thu Apr 18 07:50:18 UTC 2019


 The SCTP socket buffer used by a userspace application is not accounted by
 the cgroups subsystem. An attacker can use this flaw to cause a denial of
 service attack. Kernel 3.10.x and 4.18.x branches are believed to be

Non-trivial backporting effort. Build logs are clean. I've regression tested
these changes by moving 1 GiB of data using SCTP over the loopback interface.


Xin Long (4):
  sctp: fix the issue that a __u16 variable may overflow in
  sctp: use sk_wmem_queued to check for writable space
  sctp: implement memory accounting on tx path
  sctp: implement memory accounting on rx path

 include/net/sctp/sctp.h |  2 +-
 net/sctp/sm_statefuns.c |  6 ++++--
 net/sctp/socket.c       | 42 ++++++++++++++----------------------------
 net/sctp/ulpevent.c     | 19 ++++++++-----------
 net/sctp/ulpqueue.c     | 25 +++++++++----------------
 5 files changed, 36 insertions(+), 58 deletions(-)


More information about the kernel-team mailing list