CVE-2014-3673

The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c.

Published: Nov 10, 2014
Updated: Apr 13, 2023
CVE: CVE-2014-3673
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: High
Score: 7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
linux / linux_kernel	3.15	3.16.35
linux / linux_kernel	3.3	3.4.107
linux / linux_kernel	3.5	3.10.61
linux / linux_kernel	3.11	3.12.34
linux / linux_kernel	3.13	3.14.25
linux / linux_kernel	3.17	3.17.4
linux / linux_kernel	2.6.12	3.2.64
redhat / enterprise_linux	5.0	5.0.x
redhat / enterprise_mrg	2.0	2.0.x
canonical / ubuntu_linux	12.04	12.04.x
debian / debian_linux	7.0	7.0.x
opensuse / evergreen	11.4	11.4.x
suse / linux_enterprise_workstation_extension	12	12.x
suse / suse_linux_enterprise_server	12	12.x
suse / linux_enterprise_software_development_kit	12	12.x
suse / suse_linux_enterprise_server	11-sp2	11-sp2.x
suse / suse_linux_enterprise_server	11-sp1	11-sp1.x
suse / suse_linux_enterprise_server	10-sp4	10-sp4.x
oracle / linux	5	5.x
oracle / linux	6	6.x
oracle / linux	7	7.x

Vulnerability Database

CVE-2014-3673

Deep Security Visibility Without the Complexity