CVE-2023-53372

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix a potential overflow in sctp_ifwdtsn_skip

Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data left for the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference it as struct sctp_ifwdtsn_skip may cause coverflow.

This patch fixes it by checking the pos against "the end of the chunk - sizeof(struct sctp_ifwdtsn_skip)" in sctp_ifwdtsn_skip, similar to sctp_fwdtsn_skip.

This vulnerability is rated as Moderate because an attacker capable of supplying malformed SCTP chunks can trigger an out-of-bounds read, causing a denial of service through a kernel panic or potentially exposing uninitialized kernel memory without granting arbitrary code execution. On default installations of Red Hat Enterprise Linux, the SCTP kernel module is not loaded automatically unless explicitly requested by applications or administrator configuration. As a result, the blast radius is confined to environments where SCTP networking is actively deployed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.