CVE-2024-57938

net/sctp: Prevent autoclose integer overflow in sctp_association_init()

State: Published
Severity: 5.5 Medium
Published: Jan 21, 2025
Updated: May 11, 2026
Reserved: Jan 19, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sctp: Prevent autoclose integer overflow in sctp_association_init()

While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 94b7ed0a4896420988e1776942f0a3f67167873eAffected 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 081bdb3a31674339313c6d702af922bc29de2c53Affected 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before f9c3adb083d3278f065a83c3f667f1246c74c31fAffected 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 7af63ef5fe4d480064eb22583b24ffc8b408183aAffected 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 271f031f4c31c07e2a85a1ba2b4c8e734909a477Affected 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 2297890b778b0e7c8200d6818154f7e461d78e94Affected 9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 4e86729d1ff329815a6e8a920cb554a1d4cb5b8dAffected
LinuxLinux	3.13Affected before 3.13Not affected 5.4.289 through 5.4.Not affected 5.10.233 through 5.10.Not affected 5.15.176 through 5.15.Not affected 6.1.124 through 6.1.Not affected 6.6.70 through 6.6.Not affected 6.12.9 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 94b7ed0a4896420988e1776942f0a3f67167873eAffected
9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 081bdb3a31674339313c6d702af922bc29de2c53Affected
9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before f9c3adb083d3278f065a83c3f667f1246c74c31fAffected
9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 7af63ef5fe4d480064eb22583b24ffc8b408183aAffected
9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 271f031f4c31c07e2a85a1ba2b4c8e734909a477Affected
9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 2297890b778b0e7c8200d6818154f7e461d78e94Affected
9f70f46bd4c7267d48ef461a1d613ec9ec0d520c to before 4e86729d1ff329815a6e8a920cb554a1d4cb5b8dAffected

LinuxLinux

3.13Affected
before 3.13Not affected
5.4.289 through 5.4.*Not affected
5.10.233 through 5.10.*Not affected
5.15.176 through 5.15.*Not affected
6.1.124 through 6.1.*Not affected
6.6.70 through 6.6.*Not affected
6.12.9 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.