Description
Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-13lenny2 | DSA-1749-1 |
| Debian 4.0 | fai-kernels | 1.17+etch.24etch2 | DSA-1794-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-24etch2 | DSA-1794-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.8etch1 | DSA-1787-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.24etch2 | DSA-1794-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-128.1.1.el5 | RHSA-2009:0264 |
| RHEL 4 | kernel +10 | 2.6.9-78.0.17.EL | RHSA-2009:0331 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5.2 EUS | kernel +12 | 2.6.18-92.1.26.el5 | RHSA-2009:1055 |
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-101.el5rt | RHSA-2009:0053 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux Kernel 2.6.20/2.6.24/2.6.27_7-10 (Ubuntu 7.04/8.04/8.10 / Fedora Core 10 / OpenSuse 11.1) - SCTP FWD Memory Corruption Remote Overflow EDB-8556 · remote · Apr 28, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2009:1055 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:0331 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:0264 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:0053 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-1787-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1749-1 linux-2.6 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1794-1 linux-2.6 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 35390 third-party-advisory
- RHSA-2009:1055 vendor-advisory
- HPSBNS02449 vendor-advisory
- http://patchwork.ozlabs.org/patch/15024/
- RHSA-2009:0331 vendor-advisory
- SUSE-SA:2009:010 vendor-advisory
- 33113 vdb-entry
- RHSA-2009:0053 vendor-advisory
- 35174 third-party-advisory
- DSA-1749 vendor-advisory
- DSA-1794 vendor-advisory
- 33674 third-party-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9fcb95a105758b81ef0131cd18e2db5149f13e95
- http://support.avaya.com/elmodocs2/security/ASA-2009-114.htm
- SUSE-SA:2009:030 vendor-advisory
- USN-751-1 vendor-advisory
- 36191 third-party-advisory
- 34252 third-party-advisory
- 35011 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=478800
- ADV-2009-0029 vdb-entry
- SUSE-SA:2009:031 vendor-advisory
- RHSA-2009:0264 vendor-advisory
- oval:org.mitre.oval:def:10872 vdb-entry signature
- 33858 third-party-advisory
- 34981 third-party-advisory
- ADV-2009-2193 vdb-entry
- 34394 third-party-advisory
- DSA-1787 vendor-advisory
- 33854 third-party-advisory
- FEDORA-2009-0816 vendor-advisory
- [oss-security] 20090105 CVE request: kernel: sctp: memory overflow when FWD-TSN chunk is received with bad stream ID mailing-list
- 1022698 vdb-entry
- 34680 third-party-advisory
- 34762 third-party-advisory
- 35394 third-party-advisory