EUVD-2026-66582
GHSA-3494-mfxc-798j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reporter describes a local privilege-escalation primitive (AV:L, PR:L) gated on the non-default cookie-auth-disabled path plus heap control (AC:H); kernel memory corruption yields full C/I/A impact. NVD's AV:N/PR:N is noted but appears to overstate reachability.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate cookie AUTH state before use
When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays.
A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain.
Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.
AnalysisAI
Kernel memory corruption in the Linux SCTP stack allows a forged COOKIE_ECHO chunk to bypass validation of AUTH parameters when cookie authentication is disabled, letting an attacker who controls the echoed cookie bytes supply unchecked RANDOM lengths, HMAC identifiers, and CHUNKS lists. A forged RANDOM length yields out-of-bounds reads during key-vector construction, and a forged HMAC identifier drives a 32-byte write past a zero-length AUTH chunk - described by the reporter as a primitive for a local privilege escalation chain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the SCTP subsystem to be in use (module loaded) and, critically, endpoint cookie authentication (RFC 4895 AUTH) to be DISABLED - that specific configuration is the code path where fixed-size AUTH fields are restored from peer-controlled cookie bytes without validation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and must be reconciled rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local unprivileged user on a host where the SCTP module is loaded and endpoint cookie authentication is disabled opens an SCTP association (for example over loopback) and completes the handshake with a crafted COOKIE_ECHO carrying a forged HMAC identifier and RANDOM length. Restoration of these unvalidated AUTH fields triggers an out-of-bounds read and a 32-byte write past a zero-length AUTH chunk in kernel memory, which the attacker grooms into a privilege-escalation primitive to gain root. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the correction adds validation of the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary, rejecting invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists lacking SHA1, and forbidden chunk ids. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Linux with SCTP enabled; use your asset management and infrastructure tools to create a prioritized remediation list focused on production servers, container hosts, and cloud instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today