CVE-2008-3526

Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 27 Aug 2008, 20:00
Last modified:07 Aug 2024, 09:45

Vulnerability Summary

Overall Risk (default)
medium
32/100
CVSS Score
7.8 HIGH
v2.0 (nvd)
EPSS Score
1.91% LOW
2% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Aug 2008, 20:00
Published
Vulnerability first disclosed
07 Aug 2024, 09:45
Last Modified
Vulnerability information updated

Description

Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.

CVSS Metrics

  • v2.0•HIGH•Score: 7.8AV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 1.91%• Percentile: 84%

Techniques & Countermeasures

  • CWE-189•Numeric Errors

    Weaknesses in this category are related to improper calculation or conversion of numbers.

Affected Systems

  • linux•linux_kernel

    2.6.24 | 2.6.24:rc2 | 2.6.24:rc3 | 2.6.24.1 | 2.6.24.2 | 2.6.24.3 | 2.6.24.4 | 2.6.24.5 | 2.6.24.6 | 2.6.24.7 | 2.6.24_rc1 | 2.6.24_rc4 | 2.6.24_rc5 | 2.6.25 | 2.6.25.1 | 2.6.25.2 | 2.6.25.3 | 2.6.25.4 | 2.6.25.5 | 2.6.25.6 | 2.6.25.7 | 2.6.25.8 | 2.6.25.9 | 2.6.25.10 | 2.6.25.11 | 2.6.25.12 | 2.6.25.13 | 2.6.25.14 | 2.6.25.15 | 2.6.26 | 2.6.26.1 | 2.6.26.2 | 2.6.26.3

References (12)