MNBSD-2013-3: Kernel memory disclosure via uninitialized SCTP state cookie

Description

When initializing the SCTP state cookie sent in INIT-ACK chunks, a buffer allocated from the kernel stack is not completely zeroed, so padding bytes remain uninitialized. This uninitialized kernel memory is placed on the wire and can disclose sensitive data to a remote peer. Systems not using SCTP are unaffected. Patch obtained from FreeBSD.

Affected Versions

kernel

Recommendations

No specific recommendations provided.

References

• https://www.freebsd.org/security/advisories/FreeBSD-SA-13:10.sctp.asc
• https://www.cve.org/CVERecord?id=CVE-2013-5209

Additional Information

Aliases: CVE-2013-5209

Published: August 22, 2013
Last Modified: August 22, 2013