CVE-2014-0101: The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an…

Unscored severity · published Mar 11, 2014

CVE-2014-0101

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an…

–

CVSS

7.2%

EPSS

On KEV

Description

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

Exploitation

Is it being used?

Exploit prediction (EPSS)7.2% · higher than 94% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

2.6.24 before 3.2.56; 3.3 before 3.4.84; 3.5 before 3.10.34; 3.11 before 3.12.15; 3.13 before 3.13.7 · source: NVD

Big-ip Access Policy Manager · F5

11.1.0 through 11.5.3 · source: NVD