CVE-2013-2206

[John Johansen]

The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.

Break-Fix: - f2815633504b442ca0b0605c16bf3d88a3a0fcea

[John Johansen (jjohansen)]

CVE-2013-2206

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-51.113

---------------
linux (2.6.32-51.113) lucid; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1215005

  [ Andy Whitcroft ]

  * remove debian/changelog from git
  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060

  [ Brad Figg ]

  * Start new release

  [ Upstream Kernel Changes ]

  * Revert "x86, ptrace: fix build breakage with gcc 4.7"
    - LP: #1199154
  * ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET
    pending data
    - LP: #1205070
    - CVE-2013-4162
  * sctp: deal with multiple COOKIE_ECHO chunks
    - LP: #1194445
    - CVE-2013-2206
  * sctp: Use correct sideffect command in duplicate cookie handling
    - LP: #1194445
    - CVE-2013-2206
  * KVM: Validate userspace_addr of memslot when registered
    - LP: #1191918
    - CVE-2013-1943
  * KVM: add missing void __user * cast to access_ok() call
    - LP: #1191918
    - CVE-2013-1943
 -- Brad Figg <email address hidden> Wed, 21 Aug 2013 09:13:41 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-356.69

---------------
linux-ec2 (2.6.32-356.69) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to Ubuntu-2.6.32-51.113
  * Release Tracking Bug
    - LP: #1215239

  [ Ubuntu: 2.6.32-51.113 ]

  * remove debian/changelog from git
  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060
  * Start new release
  * Revert "x86, ptrace: fix build breakage with gcc 4.7"
    - LP: #1199154
  * ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET
    pending data
    - LP: #1205070
    - CVE-2013-4162
  * sctp: deal with multiple COOKIE_ECHO chunks
    - LP: #1194445
    - CVE-2013-2206
  * sctp: Use correct sideffect command in duplicate cookie handling
    - LP: #1194445
    - CVE-2013-2206
  * KVM: Validate userspace_addr of memslot when registered
    - LP: #1191918
    - CVE-2013-1943
  * KVM: add missing void __user * cast to access_ok() call
    - LP: #1191918
    - CVE-2013-1943
 -- Stefan Bader <email address hidden> Mon, 26 Aug 2013 16:33:40 +0200

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release