sctp Reconf Underflow

Vulnerability analysis

The SCTP stream reconfiguration mechanism tracks how many RECONF request parameters are outstanding using a simple counter. When a cached RECONF chunk bundles multiple request parameters, a duplicate response can cause the same request to be processed again, decrementing the counter and rolling back the stream output count a second time. This double rollback can underflow the output count, which is used to size stream array operations, leading to out-of-bounds memory access. The fix replaces the counter with a bitmask where each request type occupies one bit; the bit is cleared after the first matching response is processed, so subsequent duplicate responses for the same request type are ignored. The vulnerability is reachable from the network by any SCTP peer that can send RECONF response chunks to a host with an active SCTP association—no special privileges are required on the attacker's side, only network connectivity to the target.