FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Kernel memory disclosure in sctp(4)

Affected packages
9.1 <= FreeBSD-kernel < 9.1_6
8.4 <= FreeBSD-kernel < 8.4_3
8.3 <= FreeBSD-kernel < 8.3_10

Details

VuXML ID dd48d9b9-5e7e-11e6-a6c3-14dae9d210b8
Discovery 2013-08-22
Entry 2016-08-09

Problem Description:

When initializing the SCTP state cookie being sent in INIT-ACK chunks, a buffer allocated from the kernel stack is not completely initialized.

Impact:

Fragments of kernel memory may be included in SCTP packets and transmitted over the network. For each SCTP session, there are two separate instances in which a 4-byte fragment may be transmitted.

This memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way. For example, a terminal buffer might include a user-entered password.

References

CVE Name CVE-2013-5209
FreeBSD Advisory SA-13:10.sctp