CVE-2014-3687

Published: Nov 10, 2014Modified: May 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.

Affected (20)

Products: Linux: Linux Kernel · Redhat: Enterprise Mrg · Canonical: Ubuntu Linux · +5 more

Show all products

1 product

1 product

1 product

1 product

2 products

Suse Linux Enterprise Desktop

Suse Linux Enterprise Server

Opensuse

1 product

Evergreen

Suse

4 products

Linux Enterprise Real Time Extension

Linux Enterprise Software Development Kit

Linux Enterprise Workstation Extension

Suse Linux Enterprise Server

Oracle

1 product

Linux

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	2.6.27 ≤ version < 3.2.64
Linux Linux Kernel	3.11 ≤ version < 3.12.34
Linux Linux Kernel	3.13 ≤ version < 3.14.25
Linux Linux Kernel	3.15 ≤ version < 3.16.35
Linux Linux Kernel	3.17 ≤ version < 3.17.4
Linux Linux Kernel	3.3 ≤ version < 3.4.107
Linux Linux Kernel	3.5 ≤ version < 3.10.61

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Mrg	Version 2.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04

Configuration D

8 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Novell Suse Linux Enterprise Desktop	Version 12.0
Novell Suse Linux Enterprise Server	Version 12.0
Opensuse Evergreen	Version 11.4
Suse Linux Enterprise Real Time Extension	Version 11 sp3
Suse Linux Enterprise Software Development Kit	Version 12
Suse Linux Enterprise Workstation Extension	Version 12
Suse Suse Linux Enterprise Server	Version 11 sp2

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Linux	Version 5
Oracle Linux	Version 6
Oracle Linux	Version 7

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (44)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b69040d8e39f20d5215a03502a8e8b4c6ab78395

Source: secalert@redhat.com

http://linux.oracle.com/errata/ELSA-2014-3087.html

Source: secalert@redhat.com

Third Party Advisory

http://linux.oracle.com/errata/ELSA-2014-3088.html

Source: secalert@redhat.com

Third Party Advisory

http://linux.oracle.com/errata/ELSA-2014-3089.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142722450701342&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=142722544401658&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0062.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-0115.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/62428

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2014/dsa-3060

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/70766

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2417-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2418-1

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1155731

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://github.com/torvalds/linux/commit/b69040d8e39f20d5215a03502a8e8b4c6ab78395

Source: secalert@redhat.com

ExploitPatchThird Party Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b69040d8e39f20d5215a03502a8e8b4c6ab78395