CVE-2014-0101
The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.
- Affected products
- Alt Linux, Centos, Linux Kernel, Red Hat, Suse Linux Enterprise, Suse
- Linux Linux Kernel
- < 3.2.56, 3.4.84, 3.10.34, 3.12.15, 3.13.7
- Fix
- Available
- CVSS 2.0
- 7.8 HIGH
- EPSS
- 7.0% (94th percentile)
- Weakness
- CWE-476
- NVD status
- Modified
- Published
- 2014-03-11
CVE-2014-0101 at NVD
No indexed exploits for CVE-2014-0101 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2014-0101 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.