VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 6, 2020· Updated Aug 5, 2024

CVE-2019-20503

CVE-2019-20503

Description

usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.

Affected products

26

Patches

2
f1de842428b6

Bump version.

https://github.com/sctplab/usrsctpMichael TuexenJan 10, 2021via osv
commit
1 file changed · +1 −1
  • configure.ac+1 −1 modified
    @@ -28,7 +28,7 @@ dnl OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 dnl SUCH DAMAGE.
 dnl
 
-AC_INIT([libusrsctp], [0.9.3.0])
+AC_INIT([libusrsctp], [0.9.4.0])
 AM_INIT_AUTOMAKE([foreign])
 
 AC_PROG_CC
790a7a2555ae

Improve input validation for some parameters having a too small

https://github.com/sctplab/usrsctpMichael TuexenDec 20, 2019via osv
commit
2 files changed · +8 −4
  • usrsctplib/netinet/sctp_auth.c+3 −2 modified
    @@ -34,7 +34,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 352438 2019-09-17 09:46:42Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 355931 2019-12-20 15:25:08Z tuexen $");
 #endif
 
 #include <netinet/sctp_os.h>
@@ -1421,7 +1421,8 @@ sctp_auth_get_cookie_params(struct sctp_tcb *stcb, struct mbuf *m,
 		ptype = ntohs(phdr->param_type);
 		plen = ntohs(phdr->param_length);
 
-		if ((plen == 0) || (offset + plen > length))
+		if ((plen < sizeof(struct sctp_paramhdr)) ||
+		    (offset + plen > length))
 			break;
 
 		if (ptype == SCTP_RANDOM) {
  • usrsctplib/netinet/sctp_pcb.c+5 −2 modified
    @@ -34,7 +34,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 353477 2019-10-13 16:14:04Z markj $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 355931 2019-12-20 15:25:08Z tuexen $");
 #endif
 
 #include <netinet/sctp_os.h>
@@ -7247,7 +7247,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
 		if (offset + plen > limit) {
 			break;
 		}
-		if (plen == 0) {
+		if (plen < sizeof(struct sctp_paramhdr)) {
 			break;
 		}
 #ifdef INET
@@ -7463,6 +7463,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
 			if (plen > sizeof(lstore)) {
 				return (-23);
 			}
+			if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
+				return (-101);
+			}
 			phdr = sctp_get_next_param(m, offset,
 						   (struct sctp_paramhdr *)&lstore,
 						   plen);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

38

News mentions

0

No linked articles in our index yet.