EUVD-2026-45014
GHSA-7fj7-gprr-x7fm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:H/U:Red
Remote unauthenticated packet reaches the lookup before any auth (AV:N/PR:N/UI:N); reliable kernel-heap RCE needs grooming so AC:H, while kernel compromise yields full C/I/A impact.
Primary rating from Vendor (illumos).
CVSS VectorVendor: illumos
Lifecycle Timeline
3DescriptionCVE.org
The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.
AnalysisAI
Remote kernel heap corruption in the illumos SCTP stack lets an unauthenticated attacker send a crafted INIT ACK packet with malformed address parameters to trigger an out-of-bounds access during packet classification, potentially leading to remote code execution or a kernel panic. The flaw affects illumos-gate and downstream distributions (OmniOS, SmartOS/Triton) built before commit 53a3efde, and has existed since 2010 (commit a5407c02). There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is Unreported (E:U), but the attack requires no authentication or user interaction.
Technical ContextAI
The vulnerability lives in the illumos SCTP (Stream Control Transmission Protocol, RFC 9260/4960) inbound path, specifically the association-lookup logic that parses INIT ACK chunks (sctp_lookup_by_faddrs / sctp_addrlist2sctp in sctp_hash.c and sctp_cookie.c). Because a multi-homed peer may advertise additional addresses in an INIT ACK, the kernel walks the chunk's address parameters to find the matching association. The pre-patch code trusted that these parameters were validated, but sctp_check_input() only verified that parameter sizes fit within the chunk - not that individual IPv4 (8-byte) or IPv6 (20-byte) address parameters were well-formed. This is a classic CWE-122 heap-based buffer overflow: malformed sph_len values let parsing read/index past allocated heap bounds. The fix adds explicit length checks (rejecting IPv4 params whose length != 8 and IPv6 params whose length != 20), pre-allocates a correctly sized pointer/address array with kmem_zalloc bounded by the remaining bytes, and bounds the parse loop by pointer_count < most_v4.
RemediationAI
Upstream fix available (commit; released patched version not independently confirmed): apply illumos-gate commit 53a3efde (https://github.com/illumos/illumos-gate/commit/53a3efdeff8e6745bbfb69c5360f94962fb79e75) by upgrading to a distribution build that includes it - OmniOS and SmartOS/Triton users should pull the corresponding rebuilt platform image or kernel package from their vendor once it carries this commit. If an updated build cannot be deployed immediately, the most effective compensating control is to prevent unsolicited SCTP INIT ACK packets from reaching vulnerable hosts: block IP protocol 132 (SCTP) at the network perimeter or host firewall (ipf/pf) for any interface that does not legitimately terminate SCTP associations - the trade-off is that this breaks any real SCTP-based services (e.g. telecom/SIGTRAN or SCTP-enabled applications). Where SCTP is not needed at all, ensure the SCTP module is not in active use. Reference the tracking issue at https://illumos.org/issues/18117 for release status.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability
An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. Rated high severity
Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i
An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. Rated high severity
An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. Rated high severity (
An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. Rated high severity (
An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. Rated high severity (
An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. Rated high severity (
A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati
An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. Rated medium severi
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today