CVE-2014-7841
Detail
Deferred
This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.
Description
The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 2.0 Severity and Vector Strings:
Vector:
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected] .
URL
Source(s)
Tag(s)
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e40607cbe270a9e8360907cb1e62ddf0736e4864
CVE, Inc., Red Hat
http://linux.oracle.com/errata/ELSA-2015-3004.html
CVE, Inc., Red Hat
http://linux.oracle.com/errata/ELSA-2015-3005.html
CVE, Inc., Red Hat
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
CVE, Inc., Red Hat
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html
CVE, Inc., Red Hat
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE, Inc., Red Hat
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
CVE, Inc., Red Hat
http://rhn.redhat.com/errata/RHSA-2015-0087.html
CVE, Inc., Red Hat
http://rhn.redhat.com/errata/RHSA-2015-0102.html
CVE, Inc., Red Hat
http://rhn.redhat.com/errata/RHSA-2015-0284.html
CVE, Inc., Red Hat
http://rhn.redhat.com/errata/RHSA-2015-0285.html
CVE, Inc., Red Hat
http://rhn.redhat.com/errata/RHSA-2015-0695.html
CVE, Inc., Red Hat
http://secunia.com/advisories/62305
CVE, Inc., Red Hat
http://secunia.com/advisories/62597
CVE, Inc., Red Hat
http://secunia.com/advisories/62735
CVE, Inc., Red Hat
http://www.debian.org/security/2014/dsa-3093
CVE, Inc., Red Hat
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.4
CVE, Inc., Red Hat
http://www.openwall.com/lists/oss-security/2014/11/13/6
CVE, Inc., Red Hat
http://www.securityfocus.com/bid/71081
CVE, Inc., Red Hat
https://bugzilla.redhat.com/show_bug.cgi?id=1163087
CVE, Inc., Red Hat
https://github.com/torvalds/linux/commit/e40607cbe270a9e8360907cb1e62ddf0736e4864
CVE, Inc., Red Hat
Exploit
https://support.f5.com/kb/en-us/solutions/public/16000/000/sol16016.html
CVE, Inc., Red Hat
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-399
Resource Management Errors
NIST
Change History
15 change records found show changes
CVE Modified by CVE 11/20/2024 9:18:07 PM
Action
Type
Old Value
New Value
Added
Reference
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e40607cbe270a9e8360907cb1e62ddf0736e4864
Added
Reference
http://linux.oracle.com/errata/ELSA-2015-3004.html
Added
Reference
http://linux.oracle.com/errata/ELSA-2015-3005.html
Added
Reference
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
Added
Reference
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html
Added
Reference
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
Added
Reference
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0087.html
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0102.html
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0284.html
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0285.html
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0695.html
Added
Reference
http://secunia.com/advisories/62305
Added
Reference
http://secunia.com/advisories/62597
Added
Reference
http://secunia.com/advisories/62735
Added
Reference
http://www.debian.org/security/2014/dsa-3093
Added
Reference
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.4
Added
Reference
http://www.openwall.com/lists/oss-security/2014/11/13/6
Added
Reference
http://www.securityfocus.com/bid/71081
Added
Reference
https://bugzilla.redhat.com/show_bug.cgi?id=1163087
Added
Reference
https://github.com/torvalds/linux/commit/e40607cbe270a9e8360907cb1e62ddf0736e4864
Added
Reference
https://support.f5.com/kb/en-us/solutions/public/16000/000/sol16016.html
CVE Modified by Red Hat, Inc. 5/13/2024 11:22:21 PM
Action
Type
Old Value
New Value
CVE Modified by Red Hat, Inc. 2/12/2023 7:42:34 PM
Action
Type
Old Value
New Value
Changed
Description
A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system.
The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.
Removed
CVSS V2
Red Hat, Inc. (AV:N/AC:M/Au:N/C:N/I:N/A:C)
Removed
Reference
https://access.redhat.com/errata/RHSA-2015:0087 [No Types Assigned]
Removed
Reference
https://access.redhat.com/errata/RHSA-2015:0102 [No Types Assigned]
Removed
Reference
https://access.redhat.com/errata/RHSA-2015:0284 [No Types Assigned]
Removed
Reference
https://access.redhat.com/errata/RHSA-2015:0285 [No Types Assigned]
Removed
Reference
https://access.redhat.com/errata/RHSA-2015:0695 [No Types Assigned]
Removed
Reference
https://access.redhat.com/security/cve/CVE-2014-7841 [No Types Assigned]
CVE Modified by Red Hat, Inc. 2/02/2023 3:18:38 PM
Action
Type
Old Value
New Value
Changed
Description
The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.
A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system.
Added
CVSS V2
Red Hat, Inc. (AV:N/AC:M/Au:N/C:N/I:N/A:C)
Added
Reference
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e40607cbe270a9e8360907cb1e62ddf0736e4864 [No Types Assigned]
Added
Reference
https://access.redhat.com/errata/RHSA-2015:0087 [No Types Assigned]
Added
Reference
https://access.redhat.com/errata/RHSA-2015:0102 [No Types Assigned]
Added
Reference
https://access.redhat.com/errata/RHSA-2015:0284 [No Types Assigned]
Added
Reference
https://access.redhat.com/errata/RHSA-2015:0285 [No Types Assigned]
Added
Reference
https://access.redhat.com/errata/RHSA-2015:0695 [No Types Assigned]
Added
Reference
https://access.redhat.com/security/cve/CVE-2014-7841 [No Types Assigned]
Removed
Reference
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e40607cbe270a9e8360907cb1e62ddf0736e4864 [Exploit]
CVE Modified by Red Hat, Inc. 1/02/2017 9:59:12 PM
Action
Type
Old Value
New Value
Added
Reference
http://linux.oracle.com/errata/ELSA-2015-3004.html [No Types Assigned]
Added
Reference
http://linux.oracle.com/errata/ELSA-2015-3005.html [No Types Assigned]
Added
Reference
http://secunia.com/advisories/62597 [No Types Assigned]
Added
Reference
http://secunia.com/advisories/62735 [No Types Assigned]
Added
Reference
http://www.securityfocus.com/bid/71081 [No Types Assigned]
Added
Reference
https://support.f5.com/kb/en-us/solutions/public/16000/000/sol16016.html [No Types Assigned]
CVE Modified by Red Hat, Inc. 4/06/2015 9:59:42 PM
Action
Type
Old Value
New Value
Added
Reference
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
CVE Modified by Red Hat, Inc. 3/25/2015 9:59:57 PM
Action
Type
Old Value
New Value
Added
Reference
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
CVE Modified by Red Hat, Inc. 3/24/2015 9:59:07 PM
Action
Type
Old Value
New Value
Added
Reference
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html
CVE Modified by Red Hat, Inc. 3/23/2015 10:00:24 PM
Action
Type
Old Value
New Value
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0695.html
CVE Modified by Red Hat, Inc. 3/18/2015 9:59:26 PM
Action
Type
Old Value
New Value
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0102.html
CVE Modified by Red Hat, Inc. 3/17/2015 10:02:39 PM
Action
Type
Old Value
New Value
Added
Reference
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0284.html
CVE Modified by Red Hat, Inc. 3/11/2015 10:00:23 PM
Action
Type
Old Value
New Value
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0087.html
Added
Reference
http://rhn.redhat.com/errata/RHSA-2015-0285.html
CVE Modified by Red Hat, Inc. 3/05/2015 9:59:03 PM
Action
Type
Old Value
New Value
Added
Reference
http://www.debian.org/security/2014/dsa-3093
CVE Modified by Red Hat, Inc. 1/22/2015 9:01:10 AM
Action
Type
Old Value
New Value
Added
Reference
http://secunia.com/advisories/62305
Initial CVE Analysis 12/01/2014 8:37:28 AM
Action
Type
Old Value
New Value
Added
CVSS V2
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Added
CWE
CWE-399
Added
CPE Configuration
Record truncated, showing 2048 of 12501 characters.
View Entire Change Record
Configuration 1
OR
*cpe:2.3:o:linux:linux_kernel:3.0:rc1:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0:rc2:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0:rc3:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0:rc4:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0:rc5:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0:rc6:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0:rc7:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.1:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.10:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.11:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.12:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.13:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.14:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.15:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.16:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.17:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.18:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.19:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.2:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.20:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.21:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.22:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.23:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.24:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.25:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.26:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.27:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.28:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.29:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.3:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.30:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.31:*:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:3.0.32:*:*:*:*:*:*:*
*cpe:2.3:o:
Changed
Reference Type
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e40607cbe270a9e8360907cb1e62ddf0736e4864 No Types Assigned
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e40607cbe270a9e8360907cb1e62ddf0736e4864 Exploit
Changed
Reference Type
https://github.com/torvalds/linux/commit/e40607cbe270a9e8360907cb1e62ddf0736e4864 No Types Assigned
https://github.com/torvalds/linux/commit/e40607cbe270a9e8360907cb1e62ddf0736e4864 Exploit
Quick Info
CVE Dictionary Entry: CVE-2014-7841 NVD
Published Date: 11/29/2014 NVD
Last Modified: 04/12/2025
Source: Red Hat, Inc.