[security-announce] Kernel/SCTP: security update

Sona Sarmadi sona.sarmadi at enea.com
Mon Jan 12 07:35:03 CET 2015

                                            Enea Linux Security Advisory 

Product/package: Kernel/SCTP: (FSL kernel: 3.8.11)
Severity:  Important
Issue date:  2015-01-12
CVE Names: CVE-2014-5077
Layer: meta-enea
A security patch that fixes fix a NULL pointer dereference, CVE-2014-5077 is 
now available in the " http://linux.enea.com/4.0/patches " folder. 
Patch file: 0011-Kernel-SCTP-CVE-2014-5077.patch
README file: 0011-Kernel-SCTP-CVE-2014-5077.README

The sctp_assoc_update function in net/sctp/associola.c in the 
Linux kernel through 3.15.8, when SCTP authentication is enabled, 
allows remote attackers to cause a denial of service (NULL pointer 
dereference and OOPS) by starting to establish an association 
between two endpoints immediately after an exchange of INIT and 
INIT ACK chunks to establish an earlier association between these 
endpoints in the opposite direction. 


How to apply the patches
If you don't have installed the Enea Linux 4.0 Release:

# wget http://linux.enea.com/4.0/Enea-Linux-4.0.tar.gz 
# tar zxvf Enea-Linux-4.0.tar.gz

If you have already installed the Enea Linux 4.0 Release:

# cd Enea-Linux-4.0/poky/meta-enea
# wget http://linux.enea.com/4.0/patches/0011-Kernel-SCTP-CVE-2014-5077.patch
# patch -p1 < ./0011-Kernel-SCTP-CVE-2014-5077.patch

If you have any questions regarding the security patches and security updates please contact security at enea.com. 
ESRT (Enea Security Response Team)

Sona Sarmadi
Software Engineer/Security Responsible for Enea Linux
Jan Stenbecks torg 17,
Box 1033, SE-164 21 Kista, Sweden
Direct: +46 8 5071  4475
Mobile: +46 70 971 4475
sona.sarmadi at enea.com

This message, including attachments, is CONFIDENTIAL. It may also be privileged or otherwise protected by law. If you received this email by mistake please let us know by reply and then delete it from your system; you should not copy it or disclose its contents to anyone.

More information about the security-announce mailing list