CVE-2024-57938

In the Linux kernel, the following vulnerability has been resolved:

net/sctp: Prevent autoclose integer overflow in sctp_association_init()

While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow.

This vulnerability is rated as Moderate impact because exploiting it requires privileged access to modify SCTP kernel configuration parameters, restricting the blast radius to a local denial of service without compromising system confidentiality or integrity. On typical Red Hat Enterprise Linux deployments, the SCTP protocol handler is not loaded by default unless explicitly utilized by running applications. Additionally, standard out-of-the-box system configurations retain safe threshold limits that do not trigger the arithmetic overflow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.