VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Nov 19, 2024· Updated May 12, 2026

CVE-2024-50299

CVE-2024-50299

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: properly validate chunk size in sctp_sf_ootb()

A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctp_sf_ootb() to address a crash reported by syzbot:

BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Missing chunk-size validation in Linux kernel's SCTP implementation leads to uninitialized-memory access, enabling a local denial-of-service crash.

Vulnerability

Description

The vulnerability resides in the sctp_sf_ootb() function within the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The function fails to properly validate the size of incoming chunks before processing them. This oversight can cause the kernel to access uninitialized memory, leading to a system crash. This is similar to a previously fixed issue, CVE-2024-????, addressed by commit 50619dbf8db7 ("sctp: add size validation when walking chunks"). [1]

Exploitation

An attacker can trigger the bug by sending a specially crafted malformed SCTP packet to a vulnerable system. The attack requires no authentication and can be performed remotely over the network, as SCTP is a network-layer protocol. The lack of chunk size validation in sctp_sf_ootb() allows the attacker to supply a chunk with an invalid length, causing the kernel to read beyond the intended buffer boundaries. [1]

Impact

Successful exploitation results in a kernel panic due to an access to uninitialized memory ("uninit-value"), leading to a denial of service (DoS) condition. The system becomes unstable and crashes, requiring a reboot to restore normal operation. The CVSS v3.1 base score for this vulnerability is 5.5 (Medium), with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. [1] This indicates the primary impact is on availability.

Mitigation

The fix has been applied in the Linux kernel source code. Users are advised to update their kernel to a version that includes the commit referenced in the description. The vulnerability is also listed in Siemens' security advisory SSA-265688, noting that the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (all versions) is affected and should be updated accordingly. [2] No workarounds are mentioned; the recommended action is to apply the kernel patch.

References
  1. SSA-265688
  2. SSA-398330

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

114

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.