The sctp_auth_ep_set_hmacs function in net/sctp/auth.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4, when the SCTP-AUTH extension is enabled, does not verify that the identifier index is within the bounds established by SCTP_AUTH_HMAC_ID_MAX, which allows local users to obtain sensitive information via a crafted SCTP_HMAC_IDENT IOCTL request involving the sctp_getsockopt function, a different vulnerability than CVE-2008-4113.
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2008-10-06 19:54
Updated : 2024-02-04 17:33
NVD link : CVE-2008-4445
Mitre link : CVE-2008-4445
CVE.ORG link : CVE-2008-4445
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor