sctp AdaptationIndication OOB

Vulnerability analysis

The SCTP parameter verifier accepts an Adaptation Layer Indication parameter that declares only a header length, omitting the required 32-bit Adaptation Code Point field. During INIT chunk processing the parser reads four bytes past the declared parameter boundary to obtain the code point value; when the truncated parameter is last in the INIT, those bytes come from the tail of the receive buffer and are copied into the state cookie returned in the INIT ACK, disclosing up to four bytes of unrelated receive-buffer data to the remote peer. The fix adds a length check that rejects parameters whose declared length does not match the fixed structure size, aborting the association through the existing invalid-parameter-length path. Any network peer can trigger this by sending a crafted SCTP INIT to a port where the kernel is processing SCTP connections; no privileges or local access are required.