Unscored severity · published Aug 1, 2014
CVE-2014-5077
The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of…
–
CVSS
5.8%
EPSS
No
On KEV
Description
The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.8% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
2.6.24 before 3.2.63; 3.3 before 3.4.103; 3.5 before 3.10.53; 3.11 before 3.12.27; 3.13 before 3.14.17; 3.15 before 3.15.10 · source: NVD
EL
Enterprise Linux Eus · Redhat
6.5 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
6.2; 6.5 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
6.5 · source: NVD
LE
Linux Enterprise Desktop · Suse
11 · source: NVD
LE
Linux Enterprise Real Time Extension · Suse
11 · source: NVD
LE
Linux Enterprise Server · Suse
11; 11 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5077
Vendor Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1be9a950c646c9092fb3618197f7b6bfb50e82aa
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1083.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1668.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1763.html
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability